CVE-2026-33733
EspoCRM is an open source customer relationship management application.
Published Apr 22, 2026 · updated Jun 17, 2026 · espocrm espocrm
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled and values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to or under the web application user's filesystem permissions. Version 9.3.4 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 22, 2026 · NIST NVD
Detected
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled and values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use sequences to escape the intended template directory and read, create, overwrite, or delete
Jun 17, 2026 · NIST NVD
Updated
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled and values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use sequences to escape the intended template directory and read, create, overwrite, or delete
Affected
- cpe espocrm/espocrmversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33733
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33733
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled and values and pass them into template path construction without normalization or traversal filtering.
nvd.nist.gov