PT-2026-32517 · Espocrm · Espocrm

Silentsobs · Published 2026-04-13 · Updated 2026-04-14 · CVE-2026-33659

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.4

Description The '/api/v1/Attachment/fromImageUrl' endpoint is susceptible to Server-Side Request Forgery (SSRF) through a DNS rebinding (Time-of-Check to Time-of-Use) condition. This occurs because host validation utilizes the dns get record() function, while the subsequent HTTP request uses curl's internal resolver (gethostbyname()), potentially resulting in different IP addresses for the same hostname. Additionally, empty DNS results caused by failures, IPv6-only domains, or non-existent hostnames may allow hosts to bypass validation. An authenticated attacker with default attachment creation access can use this to bypass internal IP restrictions, scan internal network ports, identify internal hosts, and interact with internal HTTP-based services.

Recommendations Update to version 9.3.4.

Exploit

Fix

SSRF

Time Of Check To Time Of Use

Weakness Enumeration

CWE-918

CWE-367

Related Identifiers

CVE-2026-33659

Affected Products

Espocrm

References · 5

• 🔥 https://github.com/espocrm/espocrm/releases/tag/9.3.4 · Exploit
• 🔥 https://github.com/espocrm/espocrm/security/advisories/GHSA-6m4j-fwrx-crh7 · Exploit
• 🔥 https://github.com/espocrm/espocrm/commit/dca03cc3458e487362c26c746378a2d4de9990b1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33659 · Security Note
• https://twitter.com/CVEnew/status/2043976202507989423 · Twitter Post