EspoCRM CVE-2026-47168

Exploitation requires an authenticated EspoCRM administrator account (per CVSS PR:H and the description's 'authenticated administrator'); without admin access the crafted serialized payload cannot be placed into the background MassAction or Export parameters that are subsequently deserialized. The specific sink is the unserialize() call in Espo\Core\MassAction\Params and Espo\Tools\Export\Params (via Entities\MassAction and Entities\Export), which in versions prior to 9.3.7 did not pass an allowed_classes restriction, permitting arbitrary object instantiation. Successful code execution additionally depends on a usable PHP gadget chain being reachable in the deployed codebase/dependencies. The primary limiting factor is the administrator privilege prerequisite; no additional user interaction is required (UI:N), and the affected feature (MassAction/Export) is standard functionality rather than a non-default option.

This is a genuine high-severity flaw but with an important access caveat that tempers real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1 Critical) accurately reflects an unsafe PHP deserialization (CWE-502) yielding server code execution, but PR:H confirms the attacker must already hold authenticated administrator privileges - a significant barrier that moves this from a mass-exploitable internet threat toward a post-compromise or insider/privilege-abuse scenario. Public exploit material exists (the vendor advisory GHSA-7q78-jjr9-mqcg plus the fixing commit f48d1d2, which clearly reveals the unsanitized unserialize() calls), raising the practical exploitation likelihood for anyone who gains admin access. No EPSS score, SSVC decision, or CISA KEV data was provided in the input, so exploitation-probability and automatable signals cannot be weighed - absence of KEV means there is no confirmation of active exploitation. Net: a real priority to patch for any EspoCRM operator because admin credentials are frequently obtainable via phishing, credential reuse, or chained lower-privilege bugs, but the PR:H requirement means it is not a drive-by, wormable internet-facing threat in the way a PR:N RCE would be.

An attacker who has obtained EspoCRM administrator access (via stolen credentials, a compromised admin account, or a malicious insider) crafts a serialized PHP object payload and submits it so it is stored in background MassAction or Export parameters. When the application later deserializes that data without restricting allowed classes, the attacker-controlled object is instantiated, triggering a gadget chain that executes arbitrary code on the server. Publicly available exploit references (vendor advisory and the fixing commit) make reproducing this straightforward.