CVE-2026-55154

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only the first byte in sanitizeCellValue(). An authenticated low-privileged user can store a free-text value whose formula trigger is preceded by whitespace or a control character, causing CSV or XLSX export to omit the leading single-quote formula-neutralization prefix. When a privileged user opens the exported file and accepts applicable spreadsheet security prompts, spreadsheet software can ignore the whitespace or control-character prefix and evaluate the cell as a formula, permitting outbound data disclosure and, on legacy configurations with DDE enabled, command execution. This issue is fixed in version 9.3.9.

• CWE-1236

• https://github.com/espocrm/espocrm/commit/f209248efd0d63bc8f7906cb96c07020a758eead
• https://github.com/espocrm/espocrm/releases/tag/9.3.9
• https://github.com/espocrm/espocrm/security/advisories/GHSA-xrwp-2gph-985x

Published

Oct 15, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55145Improper neutralization of special elements used in a comman…7.1
• CVE-2026-55146LORIS (Longitudinal Online Research and Imaging System) is a…4.3
• CVE-2026-55147LORIS (Longitudinal Online Research and Imaging System) is a…6.3
• CVE-2026-55149Vouch Proxy is an SSO and OAuth/OIDC login solution for Ngin…7.5
• CVE-2026-5515IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores …5.5
• CVE-2026-55153mchange-commons-java is a Java library of shared utility cla…7.1
• CVE-2026-55156Token Optimizer MCP measures token savings per AI coding age…5.3
• CVE-2026-55157Token Optimizer MCP measures token savings per AI coding age…8.4
• CVE-2026-55158Conflibot warns in advance when merging a pull request will …9.1
• CVE-2026-55159luci-app-adblock-fast a WebUI for fast, lightweight DNS-base…8.8
• CVE-2026-5516IBM WebSphere Application Server - Liberty 22.0.0.11 through…5.9
• CVE-2026-55160Stringer is a self-hosted, anti-social RSS reader. Prior to …7.6