What is the CVSS score of CVE-2026-33733?

CVE-2026-33733 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of EspoCRM are affected by CVE-2026-33733?

CVE-2026-33733 is a path traversal vulnerability in EspoCRM's admin template management that allows authenticated administrators to read, create, or delete arbitrary files on affected servers.. A patch is available.

Is there a public PoC exploit available for CVE-2026-33733?

Yes, a public proof-of-concept exploit is available for CVE-2026-33733. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-33733?

Within 24 hours: Identify all EspoCRM instances and document current versions. Within 7 days: Upgrade all instances to EspoCRM 9.3.4 or later; if immediate upgrade is not feasible, restrict admin template access to trusted personnel only and monitor admin activity logs. Within 30 days: Conduct post-patch validation and review admin account access controls to limit unnecessary elevated privileges.

EspoCRM CVE-2026-33733

EUVD-2026-25082 HIGH

Relative Path Traversal (CWE-23)

2026-04-22 GitHub_M

Information Disclosure Espocrm

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Apr 27, 2026 - 15:08 vuln.today

Public exploit code

Patch released

Apr 27, 2026 - 15:08 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 18:42 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:54 vuln.today

Patch available

Apr 22, 2026 - 22:02 EUVD

EUVD ID Assigned

Apr 22, 2026 - 20:31 euvd

EUVD-2026-25082

Analysis Generated

Apr 22, 2026 - 20:31 vuln.today

CVE Published

Apr 22, 2026 - 20:05 nvd

HIGH 7.2

DescriptionGitHub Advisory

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled name and scope values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use ../ sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to body.tpl or subject.tpl under the web application user's filesystem permissions. Version 9.3.4 fixes the issue.

AnalysisAI

Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or delete arbitrary files on the server filesystem. The vulnerability affects all versions prior to 9.3.4 and stems from unsanitized name and scope parameters in template path construction. Publicly available exploit code exists (GitHub security advisory GHSA-44c3-xjfp-3jrh), though no CISA KEV listing or confirmed active exploitation. CVSS 7.2 reflects high impact across confidentiality, integrity, and availability, but exploitation requires high-privilege (admin) access, significantly limiting real-world exposure to insider threats or compromised admin credentials.

Technical ContextAI

This is a classic path traversal vulnerability (CWE-23) in EspoCRM's server-side template management functionality. The application constructs filesystem paths for email templates (body.tpl and subject.tpl files) by concatenating user-supplied name and scope parameters without canonicalization or directory traversal filtering. An attacker can inject ../ sequences to escape the intended template directory (e.g., data/templates/) and manipulate files elsewhere in the filesystem, limited only by the web application user's operating system permissions. The vulnerability exists in the admin panel's template CRUD endpoints, which accept these parameters and directly pass them to file operations. The affected product is identified as cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:* for all versions before 9.3.4.

RemediationAI

Upgrade EspoCRM to version 9.3.4 or later, which contains vendor-released patches that implement proper path normalization and traversal filtering for template management endpoints. The fix is confirmed in the GitHub security advisory GHSA-44c3-xjfp-3jrh at https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh. If immediate patching is not feasible, implement compensating controls: restrict admin panel access to trusted IP addresses via firewall rules or web server configuration (reduces attack surface but does not eliminate insider risk); enable comprehensive file integrity monitoring on the EspoCRM installation directory to detect unauthorized file modifications (provides detection but not prevention); audit all existing admin accounts and revoke unnecessary privileges, implementing role-based access with minimum necessary permissions (reduces number of accounts that could exploit the flaw). These workarounds carry trade-offs: IP restrictions may hinder legitimate remote administration, FIM creates operational overhead with alert fatigue, and privilege reduction may impact administrative workflows. Patching to 9.3.4 remains the only complete remediation.