EspoCRM CVE-2026-33741

The attacker must hold a valid EspoCRM account with at minimum low-privilege access (CVSS PR:L confirmed), sufficient to upload attachments to at least one attachment-capable field in the application. Victim interaction is required (CVSS UI:R): the target user must be socially engineered or otherwise induced to open the malicious SVG attachment inline in their browser - clicking a shared record link or an attachment link in an internal note satisfies this condition. The attack additionally requires that the EspoCRM instance serves SVG files as inline top-level documents rather than forced downloads, which appears to be the default behavior in affected versions. The CSP bypass component requires that the attacker can also upload a JavaScript file to the same EspoCRM instance so that it is served from the same origin. Exploitation is limited by: the need for an attacker-controlled CRM account (rules out fully external unauthenticated attackers), the need for victim click interaction (not automatable at scale), and the availability of same-origin script hosting (requires JS upload capability alongside SVG upload capability).

The CVSS 6.8 score reflects a network-reachable (AV:N), low-complexity (AC:L) vulnerability requiring a low-privilege authenticated account (PR:L) and victim interaction (UI:R), with unchanged scope (S:U) and a high confidentiality impact (C:H) alongside limited integrity and availability impact (I:L/A:L). The PR:L requirement is a meaningful constraint - the attacker must possess a valid EspoCRM account - but in multi-tenant CRM deployments this bar is often low (e.g., partner accounts, sales reps, trial users). UI:R reduces automatable mass exploitation, but social engineering within a CRM context (sharing a record, sending an internal note with an attachment) is highly plausible. A publicly available exploit exists, which elevates practical risk above typical stored-XSS findings. No CISA KEV listing is present, and EPSS data was not provided in the intelligence feed. The CSP bypass technique using a same-origin uploaded JS file is a non-trivial but well-documented attack pattern, and its presence here suggests the vulnerability was carefully researched rather than discovered incidentally. Overall, this warrants priority remediation in any deployment where untrusted or low-trust users hold accounts.

An attacker with a low-privilege EspoCRM account uploads a crafted SVG file containing a script tag referencing a second attacker-controlled JavaScript file - also uploaded as a legitimate attachment and therefore hosted on the EspoCRM origin. The attacker then shares a record or sends an internal communication containing the SVG attachment to a target user (e.g., a CRM administrator or colleague). When the victim opens the SVG link, EspoCRM serves it inline, the same-origin CSP allowance permits loading the attacker's JavaScript attachment, and the script executes in the victim's authenticated session - enabling session token theft, account takeover, or further lateral movement within the CRM. A public exploit exists, lowering the technical bar for this attack.