EspoCRM EUVD-2026-102104

Exploitation requires ALL of the following: (1) the attacker holds Email Template or PDF Template edit permission in EspoCRM, enabling them to store crafted HTML that evades the moderateSanitizeHtml() filter; (2) a separate victim user opens the malicious template specifically in edit mode (required user interaction); and (3) the instance is running with the non-default configuration clientCspDisabled set to true, since the Content-Security-Policy that is enabled by default otherwise blocks the stored payload from executing. These factors - prior authenticated template-edit access, victim interaction, and an explicitly disabled CSP - sharply limit realistic exploitation and mean default EspoCRM deployments are not affected.

This is a genuinely low-priority issue despite being a real, patch-confirmed vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N = 3.5 Low) already reflects heavy constraints: the attacker must already be an authenticated user holding Email Template or PDF Template edit permission (PR:L), and a second privileged user must open the malicious template in edit mode (UI:R). Critically, the stored payload only executes when the non-default setting clientCspDisabled is true - EspoCRM ships with Content-Security-Policy enabled, so default deployments are not exploitable, a limiting factor the base CVSS does not fully capture and which arguably warrants AC:H rather than AC:L. Exploit/commit code is publicly available (the vendor security advisory and fix commit), so proof-of-concept exists, but there is NO CISA KEV listing and no EPSS score was provided in the input; absence of EPSS/KEV data means widespread or automated exploitation cannot be asserted. Impact is bounded to session hijacking of another user (C:L), with no direct integrity or availability loss claimed. Net: a self-XSS-adjacent, privileged-insider, non-default-config stored XSS - a legitimate fix-it-on-next-cycle item, not an emergency.

A low-privilege but template-editing user of EspoCRM (prior to 9.3.9) saves an email or PDF template containing crafted HTML that slips past moderateSanitizeHtml(). When a higher-privileged colleague later opens that template in edit mode in an instance where clientCspDisabled is set to true, the script runs in the victim's browser and steals their session. A public proof-of-concept and the vendor fix commit are available.