PT-2026-27774 · Espocrm · Espocrm

Jiva · Publicado 2026-03-25 · Atualizado 2026-04-28 · CVE-2026-33656

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.4

Description The EspoCRM software contains a flaw due to the formula engine operating outside the field-level restriction layer, allowing writable access to fields marked as read-only, such as Attachment.sourceId. This allows modification of the sourceId via a formula, leading to a path traversal issue when the getFilePath() function is used without proper sanitization. An attacker can upload a webshell using chunked upload, poison the .htaccess file, and achieve Remote Code Execution (RCE) as the www-data user. Exploitation requires admin credentials and six requests. The vulnerable component is the formula engine and the getFilePath() function. The sourceId variable is directly concatenated into a file path without sanitization.

Recommendations Update to EspoCRM version 9.3.4 or later.

Exploit

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-33656

Produtos afetados

Espocrm

Referências · 14

• 🔥 https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x · Exploit
• https://twitter.com/0dayPublishing/status/2047049022557315441 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2036769582468206922 · Publicação no Twitter
• https://twitter.com/CrowdCyber_Com/status/2038099048129810839 · Publicação no Twitter
• https://reddit.com/r/selfhosted/comments/1s3ct3c/psa_if_youre_running_espocrm_933_or_earlier · Publicação no Reddit
• https://twitter.com/the_yellow_fall/status/2038889005878767761 · Publicação no Twitter
• https://twitter.com/secharvesterx/status/2036820629509255291 · Publicação no Twitter
• https://t.me/defcon_news/135368 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2047359950955888653 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33656 · Nota de Segurança
• https://twitter.com/compuchris/status/2040516835754344762 · Publicação no Twitter
• https://twitter.com/CCBalert/status/2047291002268836269 · Publicação no Twitter
• https://twitter.com/_r_netsec/status/2036789719355531569 · Publicação no Twitter
• https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656 · Publicação no Reddit