# CVE-2026-55154: EspoCRM CSV/XLSX formula injection via whitespace bypass

Source: https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-55154 · Severity: medium · CVSS 5.4 · Published 2026-10-15

EspoCRM is an open-source customer relationship management system that allows organizations to manage sales, marketing, and customer data. An authenticated user with low privileges can craft data that bypasses formula-injection protections when exported to CSV or XLSX files. When a privileged user opens the exported file, the spreadsheet software may execute formulas embedded in the data, potentially disclosing sensitive information or executing commands on legacy systems.

Technologies: [Espocrm](https://junglewise.ai/threats/technologies/espocrm). Vendors: [Espocrm](https://junglewise.ai/threats/vendors/espocrm).

## Quick answers

**Is CVE-2026-55154 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55154 being exploited in the wild.

**How severe is CVE-2026-55154?** Medium severity, with a CVSS score of 5.4, published 15 October 2026.

**Which products and versions are affected?** Espocrm prior to 9.3.9.

**Is there a fix for CVE-2026-55154?** Yes: fixed in 9.3.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55154 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55154?** Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.3.9

## Technical details

The vulnerability exists in the CSV and XLSX export processors (Csv/Processor.php, Xlsx/OpenSpoutProcessor.php, and Xlsx/PhpSpreadsheetProcessor.php) which check only the first byte of sanitizeCellValue() for formula triggers. An attacker can prepend whitespace or control characters to formula-triggering characters (=, +, -, @) to evade the single-quote prefix neutralization, allowing formula evaluation upon file opening. This requires low-privilege authentication and user interaction (privileged user accepting spreadsheet prompts), but enables data exfiltration and potential code execution on systems with Dynamic Data Exchange (DDE) enabled.

## Affected products

- EspoCRM EspoCRM prior to 9.3.9

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/espocrm/espocrm/commit/f209248efd0d63bc8f7906cb96c07020a758eead](https://github.com/espocrm/espocrm/commit/f209248efd0d63bc8f7906cb96c07020a758eead)
- [https://github.com/espocrm/espocrm/releases/tag/9.3.9](https://github.com/espocrm/espocrm/releases/tag/9.3.9)

## Related threats

- [EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial)
- [EspoCRM authorization bypass in PDF image rendering](https://junglewise.ai/threats/cve-2026-113643-a-vulnerability-was-found-in-espocrm-up-to-9-3-10-10-0-10-this)
- [EspoCRM mass-update attachment access control bypass](https://junglewise.ai/threats/cve-2026-75505-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-59994-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM unsafe deserialization in MassAction and Export](https://junglewise.ai/threats/cve-2026-47168-espocrm-is-an-open-source-customer-relationship-management)