EspoCRM CVE-2025-59428

Exploitation is gated by several concrete prerequisites drawn from the description: (1) the attacker must already possess an account with Knowledge Base edit permissions to store the malicious SVG payload in an article body; (2) EspoCRM's Knowledge Base article rendering must permit embedding SVG elements containing links (the stored-injection sink); (3) the api/v1/User endpoint must lack CSRF protection (true before 9.1.9); and (4) a victim with sufficient privileges must both click the attacker's link AND, when prompted, re-enter their credentials on the attacker-controlled page. Limiting factors that reduce real-world risk: the required insider edit role (not anonymous/remote), mandatory victim interaction plus credential re-entry, and the fix shipped in version 9.1.9 which closes the CSRF gap. There is no default-configuration, unauthenticated path.

This is a moderate, conditional risk rather than a top-tier emergency, and the signals are internally consistent on that point. The CVSS 3.1 base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a network vector but with two meaningful brakes: PR:L means the attacker must already hold a privileged role (Knowledge Base edit permissions), and UI:R means a victim must actively click a malicious link AND re-enter their credentials for the chained CSRF to succeed. EPSS is very low at 0.14% (3rd percentile), and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation. The one elevating signal is that publicly available exploit code exists (GitHub Security Advisory GHSA-c26c-wvhr-fr6r), which lowers the barrier to opportunistic use. The low EPSS despite a published PoC is coherent: exploitation requires an insider-level foothold plus specific victim behavior, which limits mass automation. No signals conflict here - all point to a real but gated privilege-escalation path. The main caveat: CVSS scope-changed (S:C) and only Low integrity impact arguably understates the outcome, since the described end state is creation of an attacker-controlled ADMINISTRATIVE account, which is effectively a full integrity compromise of the CRM. Treat as a priority to patch for any multi-user EspoCRM instance, but not as a drop-everything internet-wide threat.

An attacker who already holds a Knowledge Base editor account embeds a malicious SVG element containing a crafted link in the body of a KB article. A higher-privileged user opens the article, clicks the link, is redirected to an attacker-controlled HTML page that fires a CSRF POST to api/v1/User, and - if the victim is prompted for and supplies their credentials - a new attacker-controlled account (potentially administrative) is created. Public exploit code for this chain is available in the GitHub advisory, so the technique is reproducible.