Ghostwire

CVE-2026-33656: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in...

CRITICAL CVSS 9.5 Exploit Available 1 PoC

Published: April 22, 2026 | Last Modified: April 22, 2026

Description

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server's `open_basedir` scope. Version 9.3.4 fixes the issue.

Ghostwire Analysis — What This Means Practically

Critical CVSS score indicates maximum severity — remote code execution, authentication bypass, or complete system compromise is likely possible.
1 proof-of-concept exploit available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Proof-of-Concept Exploits (1)

JivaSecurity/ESPOCRM-RCE-POC-CVE-2026-33656

CVE-2026-33656: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in...

Description

Ghostwire Analysis — What This Means Practically

Proof-of-Concept Exploits (1)

Security Coverage (1 articles)

References