CVE-2025-55745: Webkul Unopim CSV Injection RCE Vulnerability

CVE-2025-55745 Overview

CVE-2025-55745 is a CSV injection vulnerability in UnoPim, an open-source Product Information Management (PIM) system built on the Laravel framework. The flaw affects versions 0.3.0 and prior in the Quick Export feature. Attackers with low-level privileges can inject formula operators into product or category fields that get written to exported CSV files. When a victim opens the file in a spreadsheet application such as Microsoft Excel, the injected payload may execute as a formula. Successful exploitation can lead to arbitrary code execution on the victim's workstation, including the establishment of a reverse shell. The issue is tracked under [CWE-1236] Improper Neutralization of Formula Elements in a CSV File.

Critical Impact
Authenticated attackers can inject spreadsheet formulas into UnoPim CSV exports, triggering arbitrary code execution on downstream users who open the files.

Affected Products

Webkul UnoPim versions 0.3.0 and prior
UnoPim Quick Export feature (Product Exporter)
UnoPim Quick Export feature (Category Exporter)

Discovery Timeline

2025-08-22 - CVE-2025-55745 published to NVD
2025-08-25 - Last updated in NVD database

Technical Details for CVE-2025-55745

Vulnerability Analysis

The vulnerability resides in the Quick Export workflow inside the Webkul\DataTransfer package. UnoPim's exporters write user-controlled product and category attributes directly into CSV rows without neutralizing leading formula characters. Spreadsheet applications interpret cells beginning with =, +, -, @, or tab/carriage return characters as formulas. An attacker who can edit product attributes can plant payloads that invoke functions such as DDE, HYPERLINK, or WEBSERVICE when an administrator or downstream user opens the exported file. Because the malicious code runs in the spreadsheet client, exploitation requires victim interaction but bypasses server-side protections.

Root Cause

The exporters in packages/Webkul/DataTransfer/src/Helpers/Exporters/Product/Exporter.php and packages/Webkul/DataTransfer/src/Helpers/Exporters/Category/Exporter.php lacked a sanitization layer for formula operators. Attribute values were serialized to CSV without prefixing dangerous leading characters with a neutralizing apostrophe or escape. The patch introduces a new EscapeFormulaOperators formatter that is applied to exported fields before they reach the FlatItemBuffer.

Attack Vector

Exploitation requires an authenticated user with permission to create or edit product or category data. The attacker stores a malicious payload such as =cmd|'/C calc'!A1 inside an attribute. When an administrator runs Quick Export and opens the resulting CSV in Excel, the cell is evaluated as a formula, enabling command execution through DDE or hyperlink abuse. This pattern can be chained into a reverse shell payload targeting the administrator's host.

php

// Patch excerpt - Product/Category Exporter.php
 use Webkul\DataTransfer\Contracts\JobTrackBatch as JobTrackBatchContract;
 use Webkul\DataTransfer\Helpers\Export;
 use Webkul\DataTransfer\Helpers\Exporters\AbstractExporter;
+use Webkul\DataTransfer\Helpers\Formatters\EscapeFormulaOperators;
 use Webkul\DataTransfer\Helpers\Sources\Export\ProductSource;
 use Webkul\DataTransfer\Jobs\Export\File\FlatItemBuffer as FileExportFileBuffer;
 use Webkul\DataTransfer\Repositories\JobTrackBatchRepository;

Source: UnoPim commit b25db94

Detection Methods for CVE-2025-55745

Indicators of Compromise

Product or category attribute values beginning with =, +, -, @, tab (\t), or carriage return (\r) characters.
CSV exports containing spreadsheet functions such as DDE(, HYPERLINK(, WEBSERVICE(, or IMPORTXML( inside attribute columns.
Spreadsheet client processes (e.g., excel.exe) spawning child processes like cmd.exe, powershell.exe, or mshta.exe after a CSV is opened.
Outbound network connections initiated by excel.exe or soffice.bin to attacker-controlled hosts shortly after export.

Detection Strategies

Inspect UnoPim database tables for attribute values starting with formula operator characters and alert on matches.
Hunt for unusual child process creation from Office applications following a CSV file open event on administrator endpoints.
Apply YARA or content rules to outbound CSV files exported from UnoPim before delivery to end users.

Monitoring Recommendations

Log all Quick Export jobs in UnoPim, including the requesting user and exported record IDs, for forensic review.
Monitor endpoint telemetry for Microsoft Office spawning shells, scripting hosts, or network clients.
Alert on file write events that produce CSV content containing formula prefixes outside expected automation pipelines.

How to Mitigate CVE-2025-55745

Immediate Actions Required

Upgrade UnoPim to version 0.3.1 or later, which includes the EscapeFormulaOperators formatter.
Audit existing product and category attributes for values that begin with formula operator characters and remediate them.
Restrict permissions on the Quick Export feature to trusted, authenticated roles only.
Educate administrators to preview exported CSV files in a text editor before opening them in Excel or LibreOffice Calc.

Patch Information

The fix is delivered in commit b25db9496fc147842a519d1dd42ec03c3bf00a34 and documented in GitHub Security Advisory GHSA-74rg-6f92-g6wx. The patch introduces a centralized EscapeFormulaOperators helper that is applied within both the Product and Category exporters before rows are written to the FlatItemBuffer. Upgrading to UnoPim 0.3.1 is the recommended remediation.

Workarounds

Disable the Quick Export feature until the upgrade can be applied.
Configure Microsoft Excel and LibreOffice Calc to disable Dynamic Data Exchange (DDE) and external content prompts via group policy.
Process exported CSV files through a sanitization script that prefixes any cell starting with =, +, -, or @ with a leading apostrophe before distribution.

bash

# Sanitize an exported CSV by neutralizing formula operators
sed -E 's/(^|,)([=+\-@\t\r])/\1'\''\2/g' export.csv > export.sanitized.csv