EspoCRM CVE-2026-63130

Requires an authenticated session with administrator privileges (PR:H) and access to the administrative Label Manager feature, which exposes the vulnerable getScopeData/saveLabels actions that accept 'scope' and 'language' parameters. Exploitation is limited by: (1) the need for full admin rights, which is a high bar and reduces this to a privilege-abuse/defense-in-depth concern; (2) filesystem permissions and server configuration, which bound which JSON files the web server/PHP process can actually read or write; (3) the impact being scoped to JSON files accessible to the application rather than arbitrary file types. No end-user interaction is required (UI:N), and the vector is reachable over the network against any EspoCRM instance prior to 9.3.10 whose admin panel is accessible to the attacker.

This is a moderate, low-priority issue for most environments. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L = 5.5 Medium) is the binding constraint: PR:H means exploitation requires an authenticated administrator, which the description independently confirms ('an authenticated administrator can provide crafted input'). An attacker who already holds full admin rights over EspoCRM has limited incentive to abuse a Label Manager path-traversal bug, which substantially caps real-world risk despite the AV:N network vector. Signals are largely consistent rather than conflicting: there is NO CISA KEV listing and NO EPSS value supplied, so there is no evidence of active or widespread exploitation; a POC/patch commit is publicly available but POC availability is distinct from active exploitation. One notable discrepancy: the vendor vector sets C:N, yet the description explicitly says the flaw 'permits reading ... JSON files,' which does imply some confidentiality impact (e.g., reading config JSON) - this suggests the official vector slightly understates confidentiality and should be verified with the vendor. No SSVC decision data was provided. Net assessment: a genuine post-authentication integrity flaw worth patching, but gated behind admin access and not an emergency.

An attacker who has obtained EspoCRM administrator credentials (via phishing, credential reuse, or a malicious/compromised admin) opens the administrative Label Manager and submits a crafted 'scope' or 'language' value containing path-traversal sequences. Because input is not validated, the request escapes the intended custom-language directory and lets the attacker read, overwrite, create, or delete JSON files the web application can access, subject to filesystem permissions. A public patch/commit exists demonstrating the vulnerable code path, so a working exploit is trivially reconstructable.