CVE-2026-55154

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.9

Description An authenticated low-privileged user can store a free-text value where a formula trigger is preceded by whitespace or a control character. This occurs because the sanitizeCellValue() function in the files application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php only inspects the first byte. Consequently, CSV or XLSX exports may omit the single-quote prefix used for formula neutralization. If a privileged user opens the exported file and accepts security prompts, the spreadsheet software may evaluate the cell as a formula, potentially leading to outbound data disclosure or command execution on legacy configurations with DDE (Dynamic Data Exchange, a method for transferring data between applications) enabled.

Recommendations Update to version 9.3.9.