CVE-2026-33656

critical

EspoCRM is an open source customer relationship management application.

Vendor / product: Espocrm — espocrm

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server's `open_basedir` scope. Version 9.3.4 fixes the issue.

CVSS

9.1

9.1 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-04-22 21:17

Modified: 2026-11-11 23:10

NVD status: Analyzed

Last synced 3 hours ago

Verified against the source API 2026-11-11 23:12 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

espocrm / espocrm <9.3.4

Weakness classification (CWE)

CWE-22

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x

References

https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x security-advisories@github.com
https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-11-11 23:12 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-33733