Description

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server's `open_basedir` scope. Version 9.3.4 fixes the issue.

Remediation

References

CVE-2026-33656

Related Vulnerabilities

Apache Tomcat Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-38286)

Apache Tomcat Improper Authentication Vulnerability (CVE-2012-5886)

Nexus Repository Manager Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-37152)

Joomla! Core 3.x.x Security Bypass (3.0.0 - 3.9.24)

PostgreSQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-5288)

Severity

Critical

Classification

CVE-2026-33656 CWE-22 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities