PT-2025-41935 · Espocrm · Espocrm

Published 2025-10-14 · Updated 2025-10-14 · CVE-2025-59428

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.1.9

Description EspoCRM is a customer relationship management application. A flaw allows the creation of arbitrary user accounts, including those with administrative privileges. This is achieved through a combination of stored SVG injection and insufficient CSRF protection. An attacker with Knowledge Base edit permissions can embed a malicious SVG element within the body field of a Knowledge Base article. When an authenticated user clicks this malicious link, they are redirected to an attacker-controlled HTML page that initiates a Cross-Site Request Forgery (CSRF) request targeting the /api/v1/User endpoint. If the victim provides their credentials, an attacker-controlled account is created, with the account's privileges determined by the CSRF payload. The vulnerable parameter is the body field within a Knowledge Base article.

Recommendations Update EspoCRM to version 9.1.9 or later.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2025-59428

GHSA-C26C-WVHR-FR6R

Affected Products

Espocrm

References · 5

• 🔥 https://github.com/espocrm/espocrm/security/advisories/GHSA-c26c-wvhr-fr6r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59428.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59428 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59428 · Vendor Advisory
• https://twitter.com/CVEnew/status/1978118128359166240 · Twitter Post