EspoCRM CVE-2026-33534

Exploitation requires a valid EspoCRM user account at any privilege level (CVSS PR:L confirms low-privilege authenticated access is sufficient - unauthenticated exploitation is not possible). The /api/v1/Attachment/fromImageUrl endpoint must be accessible, which is standard in default EspoCRM deployments with no special configuration required. The attacker's ability to read useful data is bounded by what services are listening on the loopback interface of the EspoCRM application server (e.g., local database admin panels, internal REST APIs, configuration endpoints bound to 127.0.0.1). Exploitation is not automatable at scale (SSVC: Automatable=no) due to the session authentication requirement. Scope is unchanged - the attacker cannot leverage this vulnerability to pivot beyond the loopback network of the application host, and there is no integrity or availability impact.

The CVSS 3.1 base score of 4.3 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) correctly reflects that the attack is network-reachable with no special complexity, but requires a valid authenticated session (PR:L) and yields only limited confidentiality exposure - reading responses from loopback-bound services. The EPSS of 0.03% (7th percentile) is strikingly low given the existence of a public exploit on Exploit-DB, consistent with the SSVC assessment of 'Automatable: no' - mass exploitation is impractical because each attempt requires valid credentials. No CISA KEV listing means active exploitation in the wild is unconfirmed through authoritative channels. The practical risk is highest in multi-tenant or SaaS EspoCRM deployments where less-trusted users hold accounts and where the application server hosts co-located internal services (e.g., metadata APIs, admin panels, internal databases) on the loopback interface. For single-tenant deployments with tightly controlled user bases, real-world risk is significantly lower than the POC availability alone might suggest.

An authenticated EspoCRM user crafts an image URL using octal loopback notation (e.g., http://0177.0.0.1:8080/admin/config) and submits it to the /api/v1/Attachment/fromImageUrl endpoint. The server's HostCheck::isNotInternalHost() function fails to identify the octal address as loopback, performs a fruitless DNS lookup, and permits the request; cURL then normalizes the address to 127.0.0.1 and fetches the internal service response, which is stored as a user-accessible attachment. A working public exploit demonstrating this technique is available on Exploit-DB (52583).