EUVD-2026-25081CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
8DescriptionNVD
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the sourceId field on Attachment entities. Because sourceId is concatenated directly into a file path with no sanitization in EspoUploadDir::getFilePath(), an attacker can redirect any file read or write operation to an arbitrary path within the web server's open_basedir scope. Version 9.3.4 fixes the issue.
AnalysisAI
Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/write on the web server by manipulating attachment sourceId fields. The vulnerability chains unsanitized user input with filesystem operations, enabling admins to overwrite or access files anywhere within PHP's open_basedir restriction. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all EspoCRM instances in use and verify current versions; restrict administrative access to formula scripting features where possible and audit recent admin activities for suspicious file operations. Within 7 days: Apply vendor-released patch version 9.3.4 to all EspoCRM deployments; conduct post-patch testing in non-production environments first. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today