Is CVE-2026-55154 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55154 being exploited in the wild.

How severe is CVE-2026-55154?

Medium severity, with a CVSS score of 5.4, published 15 October 2026.

Is there a fix for CVE-2026-55154?

Yes: fixed in 9.3.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55154 attacked?

It is attacked over the network.

Am I affected by CVE-2026-55154?

Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55154: EspoCRM CSV/XLSX formula injection via whitespace bypass

CVE-2026-55154 · Severity: medium · CVSS 5.4 · Published 2026-10-15

EspoCRM is an open-source customer relationship management system that allows organizations to manage sales, marketing, and customer data. An authenticated user with low privileges can craft data that bypasses formula-injection protections when exported to CSV or XLSX files. When a privileged user opens the exported file, the spreadsheet software may execute formulas embedded in the data, potentially disclosing sensitive information or executing commands on legacy systems.

Technologies: Espocrm. Vendors: Espocrm.

Quick answers

Is CVE-2026-55154 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55154 being exploited in the wild.
How severe is CVE-2026-55154?: Medium severity, with a CVSS score of 5.4, published 15 October 2026.
Which products and versions are affected?: Espocrm prior to 9.3.9.
Is there a fix for CVE-2026-55154?: Yes: fixed in 9.3.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55154 attacked?: It is attacked over the network.
Am I affected by CVE-2026-55154?: Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 9.3.9

Technical details

The vulnerability exists in the CSV and XLSX export processors (Csv/Processor.php, Xlsx/OpenSpoutProcessor.php, and Xlsx/PhpSpreadsheetProcessor.php) which check only the first byte of sanitizeCellValue() for formula triggers. An attacker can prepend whitespace or control characters to formula-triggering characters (=, +, -, @) to evade the single-quote prefix neutralization, allowing formula evaluation upon file opening. This requires low-privilege authentication and user interaction (privileged user accepting spreadsheet prompts), but enables data exfiltration and potential code execution on systems with Dynamic Data Exchange (DDE) enabled.

Affected products

EspoCRM EspoCRM prior to 9.3.9

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.