CVE-2026-63130

Published: Oct 15, 2026Modified: Oct 15, 2026Deferred

5.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Exploitability: 1.2 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10.

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://github.com/espocrm/espocrm/commit/31540a04ca8ea96519c7dbf2d8d2273218e69ce6

Source: security-advisories@github.com

https://github.com/espocrm/espocrm/releases/tag/9.3.10

Source: security-advisories@github.com

https://github.com/espocrm/espocrm/security/advisories/GHSA-jr5q-25fw-27f8

Source: security-advisories@github.com

Timeline

No history available yet.