EUVD-2026-22079Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable standard endpoint requires low-privilege authenticated session; impact confined to reading loopback services with no integrity or availability consequence.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.
AnalysisAI
Authenticated SSRF in EspoCRM 9.3.3 and below allows credential-holding users to bypass internal-host validation by supplying alternative IPv4 representations (e.g., octal-encoded loopback 0177.0.0.1) to the /api/v1/Attachment/fromImageUrl endpoint, causing the server to fetch and store responses from loopback-bound internal services. A public exploit is confirmed on Exploit-DB (52583), though EPSS is very low (0.03%, 7th percentile) and CISA KEV status has not been assigned, indicating limited observed mass exploitation. Vendor-released patch version 9.3.4 is available and resolves the issue.
Technical ContextAI
EspoCRM is a PHP-based open-source CRM. The root cause (CWE-918, Server-Side Request Forgery) lies in the HostCheck::isNotInternalHost() function, which relies on PHP's filter_var(..., FILTER_VALIDATE_IP) to identify and block internal addresses. PHP's filter_var with FILTER_VALIDATE_IP does not recognize non-standard IPv4 representations such as octal (e.g., 0177.0.0.1), hexadecimal, or pure integer forms. When the validator encounters such input it cannot parse, the logic falls through to a DNS resolution step; because these octal strings resolve to nothing via DNS, the host is incorrectly classified as external and safe. The cURL library used for the subsequent HTTP request normalizes the octal notation back to its canonical loopback form (127.0.0.1) and makes the connection, fully bypassing the safeguard. The confirmed attack surface is the /api/v1/Attachment/fromImageUrl API endpoint. The affected CPE is cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*, covering all versions through 9.3.3. This is a distinct bypass mechanism from CVE-2023-46736, which exploited HTTP redirect chains for SSRF in the same product.
RemediationAI
Upgrade to EspoCRM version 9.3.4 or later, available at https://github.com/espocrm/espocrm/releases/tag/9.3.4, which contains the vendor-released patch for this vulnerability per the GHSA advisory. Prior to patching, administrators should implement host-based or network-layer egress filtering on the EspoCRM application server to block outbound connections to 127.0.0.0/8 and RFC 1918 private address ranges - for example, via iptables OUTPUT rules or a WAF outbound policy targeting the web server process. Be aware that overly broad egress restrictions may break legitimate EspoCRM integrations that fetch external images or webhook payloads; validate filtering rules in a staging environment before production deployment. Additionally, auditing which user accounts hold EspoCRM credentials and applying least-privilege principles reduces the pool of potential attackers, since the vulnerability requires an authenticated session.
Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local
Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any ext
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. Rated high severity (CVSS 8.8), this vulnerability is rem
Authorization bypass in EspoCRM 5.8.5 lets an authenticated low-privilege user reuse or manipulate Basic-Authorization a
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating
Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or d
Stored cross-site scripting in EspoCRM 9.3.3 and below enables an authenticated attacker to execute arbitrary JavaScript
EspoCRM's POST /api/v1/EmailTemplate/:id/prepare endpoint exposes an IDOR-class ACL bypass (CWE-639) allowing authentica
EspoCRM is an Open Source CRM (Customer Relationship Management) software. Rated medium severity (CVSS 6.5), this vulner
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s brow
EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. Rated m
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today