EspoCRM vulnerabilities
We track 13 vulnerabilities in EspoCRM products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest EspoCRM vulnerabilities
- 8.0 High severity
espocrm: Improper Neutralization of Input During Web Page Generation
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an admin
- 7.3 High severity
espocrm: Improper Neutralization of Input During Web Page Generation
EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an
- 7.5 High severity
espocrm: Inefficient Regular Expression Complexity
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can con
- 7.6 High severity
espocrm: Improper Neutralization of Special Elements used in an SQL Command
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex express
- 9.1 Critical severity
espocrm: Deserialization of Untrusted Data
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the appl
- 7.7 High severity
espocrm: Insufficiently Protected Credentials
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can req
- 7.2 High severity
espocrm: Relative Path Traversal
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or
- 9.1 Critical severity
espocrm: Improper Limitation of a Pathname to a Restricted Directory
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attac
- 8.5 High severity
espocrm: Improper Neutralization of Special Elements in Output Used by a Downstream Component
EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to complete page defacement imitating the login page. Authenticated users with the read knowledge article pri
- 7.2 High severity
EspoCRM: Unrestricted Upload of File with Dangerous Type
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution.
- 7.2 High severity
EspoCRM: Unrestricted Upload of File with Dangerous Type
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.
- 8.0 High severity
Espocrm: Improper Neutralization of Formula Elements in a CSV File
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious sy
- 8.8 High severity
Espocrm: Unrestricted Upload of File with Dangerous Type
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the server to compromise the server.