Epic Data Handling Flaw in EspoCRM by EspoCRM

CVE-2026-55154

What is CVE-2026-55154?

EspoCRM, the open-source CRM application, contains a significant data handling flaw in the export functionality for CSV and XLSX formats. Prior to version 9.3.9, the application did not adequately sanitize cell values, allowing authenticated low-privileged users to input free-text values with leading whitespace or control characters. This flaw could result in maliciously crafted export files that evade spreadsheet security mechanisms. When a privileged user opens such a file, they may unwittingly trigger formula evaluation, potentially exposing sensitive data or executing commands through legacy configurations that enable DDE. This critical vulnerability has been addressed in the latest release, version 9.3.9.

References