EspoCRM CVE-2026-33656

Requires authenticated access with administrative privileges (PR:H in CVSS vector) to EspoCRM's formula scripting interface where Attachment entity manipulation is permitted. The vulnerability specifically requires the ability to update the sourceId field on Attachment objects through the formula engine, which is an admin-level capability in EspoCRM's default role-based access control configuration. Exploitation is limited to files within the web server's PHP open_basedir restriction scope - if open_basedir is tightly configured, traversal impact is constrained to that directory tree. No additional user interaction or non-default configuration is required once admin access is achieved. Network-accessible attack vector (AV:N) means the exploitation can occur remotely over HTTP/HTTPS without local shell access to the server.

Real-world risk is significant but contextually limited. The CVSS 9.1 Critical rating reflects maximum confidentiality, integrity, and availability impact with Changed scope, indicating an authenticated admin can read sensitive configuration files, overwrite application code for webshells, or corrupt critical data structures. However, the PR:H requirement means only users with administrative privileges can exploit this - the threat model is primarily malicious insiders, compromised admin accounts, or chained attacks where initial access is gained through separate vulnerabilities. The Changed scope is particularly concerning as it suggests filesystem operations can escape application-level sandboxing within open_basedir limits. Publicly available exploit code (GitHub security advisory GHSA-7922-x7cf-j54x) lowers the skill barrier for exploitation. EPSS score was not provided in the intelligence data, preventing assessment of observed exploitation probability. No CISA KEV listing indicates this is not currently exploited at scale in the wild. The vendor-released patch in version 9.3.4 provides clear remediation path. Organizations should prioritize this based on: (1) whether admin accounts could be compromised through phishing or credential reuse, (2) multi-tenant deployments where Changed scope has broader blast radius, and (3) environments where EspoCRM runs with elevated filesystem permissions beyond typical web application sandboxing.

A malicious administrator or attacker with compromised admin credentials logs into EspoCRM and accesses the formula scripting interface. Using the built-in formula engine, they craft an update operation targeting an Attachment entity, setting the sourceId field to a path traversal payload like '../../../config/config.php' or '../../../../var/www/html/shell.php'. When EspoCRM's getFilePath() method processes this manipulated sourceId, the unsanitized input is concatenated directly into filesystem operations, allowing the attacker to read sensitive configuration files containing database credentials, overwrite application code with a webshell for persistent access, or corrupt critical system files to cause denial of service. Public exploit code from the GitHub advisory provides ready-to-use proof-of-concept, lowering technical barriers.