PT-2026-27774 · Espocrm · Espocrm

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-33656

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.4

Description The EspoCRM software contains a flaw due to the formula engine operating outside the field-level restriction layer, allowing writable access to fields marked as read-only, such as Attachment.sourceId. This allows modification of the sourceId via a formula, leading to a path traversal issue when the getFilePath() function is used without proper sanitization. An attacker can upload a webshell using chunked upload, poison the .htaccess file, and achieve Remote Code Execution (RCE) as the www-data user. Exploitation requires admin credentials and six requests. The vulnerable component is the formula engine and the getFilePath() function. The sourceId variable is directly concatenated into a file path without sanitization.

Recommendations Update to EspoCRM version 9.3.4 or later.

Related Identifiers

CVE-2026-33656

Affected Products

Espocrm

References · 5

• https://reddit.com/r/selfhosted/comments/1s3ct3c/psa_if_youre_running_espocrm_933_or_earlier · Reddit Post
• https://twitter.com/VulmonFeeds/status/2036769582468206922 · Twitter Post
• https://twitter.com/secharvesterx/status/2036820629509255291 · Twitter Post
• https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656 · Reddit Post
• https://twitter.com/_r_netsec/status/2036789719355531569 · Twitter Post