EspoCRM CVE-2026-53575

Exploitation requires an authenticated EspoCRM administrator (CVSS PR:H) who can modify the applicationName configuration setting; the crafted content is injected via CSP nonce injection and rendered unescaped into the main application page, where it persists for all users. The decisive limiting factor is the administrator privilege requirement - this is not a remote unauthenticated flaw, and the attacker must already hold the highest application privilege. A second limiting factor is that impact is confined to script execution in users' browser sessions leaking page data and unsaved input (C:L, I:N, A:N); there is no server-side code execution or integrity/availability impact. Affected: all EspoCRM versions prior to 9.3.9; fixed in 9.3.9.

This is a genuinely low-priority issue despite having a publicly available POC. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, score 2.7) correctly reflects the core limitation: exploitation requires PR:H - an authenticated administrator - who must deliberately place crafted content into the applicationName setting. An admin already has full control over the application, so the attacker and the privileged victim-population are effectively the same trust tier; the realistic threat is an admin targeting lower-privileged users' sessions, or a compromised/rogue admin account, not arbitrary remote exploitation. No EPSS score was provided in the input, and the CVE is NOT in CISA KEV (no confirmed active exploitation). POC code exists (vendor GitHub security advisory plus the fixing commit), which raises reproducibility but does not indicate in-the-wild use - these are distinct signals. The low confidentiality-only impact (C:L, I:N, A:N) matches a persistent XSS that leaks page data/unsaved input rather than granting code execution or full account takeover. No SSVC decision data was supplied. Overall: high reproducibility but very low privilege-adjusted risk; the PR:H gate is the decisive de-prioritizing factor and the CVSS score of 2.7 is credible.

A malicious or compromised EspoCRM administrator sets the applicationName configuration value to a payload that abuses CSP nonce injection, which is then rendered unescaped into the main application page served to all users. When a regular user loads the application, the attacker-controlled JavaScript executes in their session and exfiltrates page data, including unsaved form input. A public POC exists in the vendor's GitHub security advisory (GHSA-f34h-xxmv-j9xp) and the fixing commit, so exploitation is readily reproducible, though it still requires the high administrator privilege level indicated by CVSS PR:H.