What is the CVSS score of CVE-2026-33656?

CVE-2026-33656 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of EspoCRM are affected by CVE-2026-33656?

CVE-2026-33656 is a critical path traversal vulnerability in EspoCRM's formula scripting engine that enables authenticated administrators to read and write arbitrary files on the web server,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-33656?

Yes, a public proof-of-concept exploit is available for CVE-2026-33656. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-33656?

Within 24 hours: Identify all EspoCRM instances in use and verify current versions; restrict administrative access to formula scripting features where possible and audit recent admin activities for suspicious file operations. Within 7 days: Apply vendor-released patch version 9.3.4 to all EspoCRM deployments; conduct post-patch testing in non-production environments first. Within 30 days: Perform forensic review of file system access logs during the vulnerability window; validate that no unauthorized files were accessed or modified; implement role-based access controls to limit formula scripting to trusted administrators only.

EspoCRM CVE-2026-33656

EUVD-2026-25081 CRITICAL

Path Traversal (CWE-22)

2026-04-22 GitHub_M

Path Traversal Espocrm

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Apr 27, 2026 - 17:04 vuln.today

Public exploit code

Patch released

Apr 27, 2026 - 17:04 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 16:12 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:45 vuln.today

Patch available

Apr 22, 2026 - 22:02 EUVD

EUVD ID Assigned

Apr 22, 2026 - 20:31 euvd

EUVD-2026-25081

Analysis Generated

Apr 22, 2026 - 20:31 vuln.today

CVE Published

Apr 22, 2026 - 20:01 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the sourceId field on Attachment entities. Because sourceId is concatenated directly into a file path with no sanitization in EspoUploadDir::getFilePath(), an attacker can redirect any file read or write operation to an arbitrary path within the web server's open_basedir scope. Version 9.3.4 fixes the issue.

Articles & Coverage 1

POC CVE-2026-33656: EspoCRM RCE via Formula ACL Bypass & Path Traversal Mar 25, 2026

AnalysisAI

Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/write on the web server by manipulating attachment sourceId fields. The vulnerability chains unsanitized user input with filesystem operations, enabling admins to overwrite or access files anywhere within PHP's open_basedir restriction. Publicly available exploit code exists. Vendor-released patch version 9.3.4 addresses this critical issue. Despite the 9.1 CVSS score and Changed scope indicating potential container escape or cross-tenant impact, EPSS data was not provided to assess real-world exploitation likelihood.

Technical ContextAI

EspoCRM implements a built-in formula scripting engine for business logic automation. The vulnerability exists in the attachment handling subsystem where the getFilePath() method in EspoUploadDir directly concatenates user-controlled sourceId values into filesystem paths without validation or sanitization. This is a classic CWE-22 path traversal vulnerability where an attacker can inject directory traversal sequences like '../' to escape intended directory boundaries. The CVSS vector shows Changed Scope (S:C), indicating the vulnerability can affect resources beyond its security scope - in this context, the formula engine's trust boundary is violated to access the broader filesystem. The attack requires high privileges (PR:H) as administrative access to EspoCRM is necessary to manipulate Attachment entities through the formula interface, but once authenticated the attack has low complexity (AC:L) with no user interaction required.

RemediationAI

Upgrade EspoCRM to version 9.3.4 or later, which implements input sanitization in the getFilePath() method to prevent path traversal attacks on sourceId fields. The vendor advisory at https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x contains upgrade instructions and patch details. If immediate patching is not feasible, implement compensating controls: restrict administrative access through multi-factor authentication and principle of least privilege to minimize insider threat surface; configure PHP open_basedir directives as restrictively as possible to limit filesystem access scope even if traversal succeeds; enable comprehensive file integrity monitoring on the web server to detect unauthorized modifications to application files or configuration; audit formula scripts created by administrators for suspicious file path manipulation patterns. Note that access restrictions only reduce attack surface - they do not eliminate the vulnerability, and determined attackers with legitimate admin credentials can still exploit the flaw. Deploy the vendor patch as the only complete remediation.