CVE-2026-55154— EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export
Quick assessment
Affected
espocrm espocrm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EspoCRM 是一款开源客户关系管理应用程序。在 9.3.9 版本之前，文件 、 以及 中的 函数仅检查第一个字节。经过身份验证的低权限用户可以存储一个自由文本值，其公式触发符之前带有空格或控制字符，从而导致 CSV 或 XLSX 导出时省略用于中和公式的前导单引号。当高权限用户打开导出的文件并接受相应的电子表格安全提示时，电子表格软件可能会忽略空格或控制字符前缀，并将单元格视为公式进行评估，从而允许外发数据泄露，并且在启用 DDE 的旧配置下，还可能实现命令执行。此问题已在 9.3.9 版本中修复。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55154
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export
Source: CVE Program / CVE List V5
Vulnerability Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only the first byte in sanitizeCellValue(). An authenticated low-privileged user can store a free-text value whose formula trigger is preceded by whitespace or a control character, causing CSV or XLSX export to omit the leading single-quote formula-neutralization prefix. When a privileged user opens the exported file and accepts applicable spreadsheet security prompts, spreadsheet software can ignore the whitespace or control-character prefix and evaluate the cell as a formula, permitting outbound data disclosure and, on legacy configurations with DDE enabled, command execution. This issue is fixed in version 9.3.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1236
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-55154
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55154
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55154 (1)
Vendor Advisories for CVE-2026-55154 (1)
Vendor Pages for CVE-2026-55154 (1)
-
🔗 Release 9.3.9 · espocrm/espocrm · GitHub x_refsource_MISC
Same Patch Batch · espocrm · 2026-10-15 · 12 CVEs total
| CVE-2026-47168 | 9.1 CRITICAL | EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export para |
| CVE-2026-53574 | 7.6 HIGH | EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression |
| CVE-2026-46691 | 6.5 MEDIUM | EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users |
| CVE-2026-46694 | 6.5 MEDIUM | EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes |
| CVE-2026-77460 | 6.5 MEDIUM | EspoCRM: Mass email template renderer leaks restricted record fields |
| CVE-2026-75505 | 6.0 MEDIUM | EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permis |
| CVE-2026-63130 | 5.5 MEDIUM | EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.jso |
| CVE-2026-46708 | 4.3 MEDIUM | EspoCRM: Target list Opt-Out actions allows opting out record without access Target List a |
| CVE-2026-59994 | 4.3 MEDIUM | EspoCRM: Pre-authentication stored HTML injection in stream notification emails about emai |
| CVE-2026-55184 | 3.5 LOW | EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled |
| CVE-2026-53575 | 2.7 LOW | EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user |
IV. Related Vulnerabilities
Same product: espocrm
-
CVE-2026-75505
EspoCRM: Access control bypass in Mass Update letting regula -
CVE-2026-77460
EspoCRM: Mass email template renderer leaks restricted recor -
CVE-2026-63130
EspoCRM: Admin path traversal in LabelManager (Custom Label -
CVE-2026-59994
EspoCRM: Pre-authentication stored HTML injection in stream -
CVE-2026-55184
EspoCRM: Stored XSS in wysiwyg template fields if CSP is dis
Same vendor: espocrm
-
CVE-2026-75505
EspoCRM: Access control bypass in Mass Update letting regula -
CVE-2026-77460
EspoCRM: Mass email template renderer leaks restricted recor -
CVE-2026-63130
EspoCRM: Admin path traversal in LabelManager (Custom Label -
CVE-2026-59994
EspoCRM: Pre-authentication stored HTML injection in stream -
CVE-2026-55184
EspoCRM: Stored XSS in wysiwyg template fields if CSP is dis
Same weakness: CWE-1236
-
CVE-2026-109396
Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injec -
CVE-2026-93581
Insufficient Neutralization of Formula Elements in CSV Expor -
CVE-2026-108579
OpenPanel through 2.3.0 CSV Formula Injection via Cohort Mem -
CVE-2026-100564
OpenClaw before 2026.8.1 CSV Formula Injection via Attendanc -
CVE-2026-100563
OpenClaw before 2026.8.1 CSV Formula Injection via Session L
V. Comments for CVE-2026-55154
No comments yet