CVE-2026-33656

Published: Apr 22, 2026Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server's `open_basedir` scope. Version 9.3.4 fixes the issue.

Affected (1)

Products: Espocrm: Espocrm

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Espocrm Espocrm	Before 9.3.4

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.