PT-2026-27774 · Espocrm · Espocrm
Jiva
·
Published
2026-03-25
·
Updated
2026-04-28
·
CVE-2026-33656
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
EspoCRM versions prior to 9.3.4
Description
The EspoCRM software contains a flaw due to the formula engine operating outside the field-level restriction layer, allowing writable access to fields marked as read-only, such as
Attachment.sourceId. This allows modification of the sourceId via a formula, leading to a path traversal issue when the getFilePath() function is used without proper sanitization. An attacker can upload a webshell using chunked upload, poison the .htaccess file, and achieve Remote Code Execution (RCE) as the www-data user. Exploitation requires admin credentials and six requests. The vulnerable component is the formula engine and the getFilePath() function. The sourceId variable is directly concatenated into a file path without sanitization.Recommendations
Update to EspoCRM version 9.3.4 or later.
Exploit
Fix
RCE
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Espocrm