EUVD-2026-105252
GHSA-w8vm-3g62-56g7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege EspoCRM user
-
ExploitSupply unauthorized attachment ID in template image source
-
ExecutionTrigger PDF rendering via ImageSourceProvider::get
-
ImpactRetrieve otherwise-restricted attachment data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated EspoCRM account with at least low-level privileges (CVSS PR:L) and the ability to create or modify PDF templates whose image source references an attachment by ID; the vulnerable code path is ImageSourceProvider::get in the PDF rendering pipeline (application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php), reached by rendering a template to PDF. The limiting factor is that no anonymous/unauthenticated access works - the attacker must already have a valid session and template access - and impact is confined to reading attachment data referenced by a guessable or known ID (confidentiality only); there is no integrity or availability impact and no user interaction by a victim is required. |
| Impact | This is a moderate, not a high-priority, issue. The authoritative CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a network-reachable, low-complexity flaw that nonetheless REQUIRES existing low-level authentication (PR:L) and yields only limited confidentiality impact (VC:L) with no integrity or availability impact - consistent with CWE-639 (authorization bypass through user-controlled key / IDOR). Public exploit code exists (referenced via the vendor GitHub security advisories and VulDB), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation. The source-code evidence confirms the fix adds ACL-based validation (new Espo\Tools\Pdf\Util\Validation plus a Template before-save hook), corroborating that the root cause is missing authorization enforcement when an attacker-controlled attachment ID is supplied to the PDF image-source path rather than a true authentication bypass. Net: a real but bounded post-authentication information-disclosure bug; prioritize patching for multi-tenant/multi-user EspoCRM deployments, but it is not an unauthenticated critical. Note the Tags label 'Authentication Bypass' conflicts with the description and CWE, which both say authorization bypass - verify terminology before triage. |
| Exploit ScenarioDerived | A low-privileged but authenticated EspoCRM user crafts or edits a PDF template so its image source references an attachment ID belonging to another user or entity they should not access. When the template is rendered through the Dompdf ImageSourceProvider::get path, the missing authorization check causes the server to fetch and embed that unauthorized attachment, disclosing its contents. Public exploit code is referenced in the vendor GitHub advisories, lowering the bar to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
An authorization bypass (IDOR) in EspoCRM's PDF rendering pipeline lets an authenticated low-privilege user read attachments they should not be able to access by supplying an arbitrary attachment ID as the image source of a PDF template. Affected versions are EspoCRM up to 9.3.10 and 10.0.10; the flaw resides in ImageSourceProvider::get (application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php) and is reached simply by rendering a template to PDF. Impact is limited to confidentiality of attachment data (CVSS 5.3, PR:L, no victim interaction), publicly available exploit code exists, and there is no indication of active exploitation in the wild.
RemediationAI
Apply the upstream fix, either by upgrading EspoCRM past the affected range (anything newer than 9.3.10 on the 9.x line and newer than 10.0.10 on the 10.x line) or, if you build from source, by cherry-picking commit 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2, which adds the Template before-create/before-update save hook and the Espo\Tools\Pdf\Util\Validation checks; release notes and the two GitHub security advisories (GHSA-r277-qh74-r86f and GHSA-w46f-mj7x-v5c6) should be checked because a specific tagged release version containing the fix is not independently confirmed from the available data. Until patched, reduce exposure by restricting the Template entity's create/edit permissions to trusted administrator roles (trade-off: delegated users lose self-service PDF template customization), and by tightening Attachment ACLs so that sensitive documents are only visible to the teams/roles that need them, which blunts the IDOR even if a template reference is accepted. Review existing PDF templates for image sources pointing at attachment IDs outside the owning user's scope and delete any that are unexpected; after patching, note that saving templates containing disallowed attachment references will now fail validation, so legitimate templates using cross-team attachments must be re-shared explicitly with the template author rather than referenced by ID.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EspoCRM is a PHP-based CRM that generates PDF documents through the Dompdf library; its PDF tooling accepts a template definition whose content can reference images by an internal identifier, which the ImageSourceProvider class resolves into an actual attachment stream at render time. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the provider trusts the caller-supplied attachment ID and fetches the corresponding Attachment entity without verifying that the requesting user's ACL grants read access to that record, so a template author can pivot from a permitted template-edit action into reading arbitrary attachments. Because the lookup is a simple identifier dereference, exploitation only requires a valid session, the ability to create or modify a PDF template, and a guessable or known attachment ID. The upstream fix commit 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2 addresses the class of problem by introducing a Template save/update hook (Espo\Classes\RecordHooks\Template\BeforeSaveValidation) plus a new validation component (Espo\Tools\Pdf\Util\Validation) that inspects template body/header/footer content for image references and enforces ACL and BadRequest/Forbidden checks before the template is persisted - i.e., the dangerous reference is rejected at save time rather than only at render time.
Know when Espocrm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable PDF rendering endpoint with low complexity, but an authenticated low-privilege account is required (PR:L); impact is limited unauthorized attachment disclosure, so C:L and I/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local
PHP object deserialization in EspoCRM versions prior to 9.3.7 lets an authenticated administrator achieve remote code ex
Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any ext
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. Rated high severity (CVSS 8.8), this vulnerability is rem
Authorization bypass in EspoCRM 5.8.5 lets an authenticated low-privilege user reuse or manipulate Basic-Authorization a
EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored I
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to i
Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or d
Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to inter
Stored cross-site scripting in EspoCRM 9.3.3 and below enables an authenticated attacker to execute arbitrary JavaScript
Exploit-DB