EUVD-2026-25082Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
8DescriptionGitHub Advisory
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled name and scope values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use ../ sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to body.tpl or subject.tpl under the web application user's filesystem permissions. Version 9.3.4 fixes the issue.
AnalysisAI
Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or delete arbitrary files on the server filesystem. The vulnerability affects all versions prior to 9.3.4 and stems from unsanitized name and scope parameters in template path construction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated administrative access to the EspoCRM installation - specifically, a user account with permissions to manage email templates through the admin panel. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate despite the 7.2 CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with compromised EspoCRM administrator credentials (obtained via phishing, credential stuffing, or supply-chain attack) logs into the admin panel and navigates to the template management interface. They craft a malicious template creation request with `name` set to `../../../../config` and `scope` manipulated to traverse to the application root, targeting `data/config.php` (EspoCRM's main configuration file). … |
| Remediation | Upgrade EspoCRM to version 9.3.4 or later, which contains vendor-released patches that implement proper path normalization and traversal filtering for template management endpoints. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all EspoCRM instances and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today