EUVD-2026-22081Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Network delivery via web interface requires a valid low-privilege account; email recipient must actively open the message; no scope change as impact is confined to email rendering.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard (non-administrative) privileges to inject arbitrary HTML into system-generated email notifications by crafting malicious content in the post field of stream activity notes. The vulnerability exists because server-side Handlebars templates render the post field using unescaped triple-brace syntax, the Markdown processor preserves inline HTML by default, and the rendering pipeline explicitly skips sanitization for fields present in additionalData, creating a path where attacker-controlled HTML is accepted, stored, and rendered directly into emails without any escaping. Since the emails are sent using the system's configured SMTP identity (such as an administrative sender address), the injected content appears fully trusted to recipients, enabling phishing attacks, user tracking via embedded resources like image beacons, and UI manipulation within email content. The @mention feature further increases the impact by allowing targeted delivery of malicious emails to specific users. This issue has been fixed in version 9.3.4.
AnalysisAI
Stored HTML injection in EspoCRM 9.3.3 and below allows any authenticated low-privilege user to embed arbitrary HTML into system-generated email notifications by crafting malicious content in stream activity post fields. Emails are delivered under the system's trusted SMTP identity, making injected content appear fully legitimate to recipients and enabling phishing, user tracking via image beacons, and UI manipulation - with the @mention feature enabling precise targeting of specific users. A public proof-of-concept exists per the GitHub advisory; no active exploitation has been confirmed in CISA KEV, and EPSS sits at 0.03% (8th percentile), indicating limited real-world exploitation activity at time of analysis.
Technical ContextAI
EspoCRM (cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*) uses server-side Handlebars templates to generate email notifications. The stream activity post field is rendered with triple-brace unescaped syntax ({{{post}}}), which explicitly bypasses Handlebars' default HTML escaping. Compounding this, the Markdown processor used by EspoCRM preserves inline HTML by default rather than stripping it, and the rendering pipeline explicitly omits sanitization for fields present in the additionalData object. This creates a three-layer failure: no escaping at the template layer, no stripping at the Markdown layer, and a deliberate sanitization bypass at the pipeline layer. CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) is the root cause class - user-supplied HTML tags are accepted, stored, and later interpreted in an email rendering context without neutralization. The SMTP delivery mechanism then launders the injected content through an administratively trusted sender identity.
RemediationAI
Upgrade to EspoCRM 9.3.4, which resolves this CVE alongside five other security fixes (CVE-2026-33741, CVE-2026-33740, CVE-2026-33733, CVE-2026-33659, CVE-2026-33656); the release is available at https://github.com/espocrm/espocrm/releases/tag/9.3.4. If immediate upgrade is not possible, consider disabling stream activity email notifications as a compensating control - note this will reduce real-time collaboration visibility for CRM users. Restricting the ability to create stream posts to a minimal set of trusted users via role-based access control can also limit the attack surface, though it does not eliminate the underlying flaw. Configuring recipient email clients to disable remote image loading will neutralize tracking beacon abuse but will not prevent phishing content from rendering. Vendor-released patch version 9.3.4 is confirmed by the GitHub release notes.
Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local
Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any ext
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. Rated high severity (CVSS 8.8), this vulnerability is rem
Authorization bypass in EspoCRM 5.8.5 lets an authenticated low-privilege user reuse or manipulate Basic-Authorization a
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating
Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or d
Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to inter
Stored cross-site scripting in EspoCRM 9.3.3 and below enables an authenticated attacker to execute arbitrary JavaScript
EspoCRM's POST /api/v1/EmailTemplate/:id/prepare endpoint exposes an IDOR-class ACL bypass (CWE-639) allowing authentica
EspoCRM is an Open Source CRM (Customer Relationship Management) software. Rated medium severity (CVSS 6.5), this vulner
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s brow
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today