CVE-2026-55154 | EspoCRM up to 9.3.8 Export Processor Processor.php sanitizeCellValue code injection

October 15, 2026 Yanac

A vulnerability, which was classified as problematic, was found in EspoCRM up to 9.3.8. This impacts the function sanitizeCellValue of the file application/Espo/Tools/Export/Format/Csv/Processor.php of the component Export Processor. The manipulation results in code injection.

This vulnerability is known as CVE-2026-55154. It is possible to launch the attack remotely. No exploit is available.

You should upgrade the affected component.VulDB Recent EntriesRead More