EspoCRM’s export modules for CSV and XLSX only examine the first byte of cell content during sanitization. When a formula trigger is preceded by whitespace or a control character, the leading single‑quote that normally neutralizes spreadsheet formulas is omitted in the exported file. As a result, if a privileged user opens the file and accepts spreadsheet security prompts, the software can evaluate the cell as a formula, exposing outbound data. In legacy configurations where Dynamic Data Exchange (DDE) is enabled, the formula can also trigger arbitrary command execution.

The vulnerability affects EspoCRM deployments running any version prior to 9.3.9. The issue is documented for the exports spoken by application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php. Users running version 9.3.9 or later have the issue fixed.

The CVSS score of 5.4 indicates a moderate severity, with an EPSS score of less than 1% suggesting a low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to submit a crafted free‑text value as a low‑privileged user and then convince a privileged user to export and open the resulting spreadsheet. Spreadsheet software must accept security prompts and interpret the leading whitespace or control character, which is typically a deliberate interaction step. The overall risk is therefore moderate, contingent on the presence of privileged users who may act on exported files that contain malicious worksheet content.