Is CVE-2026-33534 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33534 being exploited in the wild.

How severe is CVE-2026-33534?

Medium severity, with a CVSS score of 4.3, published 13 April 2026.

Is there a fix for CVE-2026-33534?

A patch was published on 2026-03-24: Version 9.3.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33534 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33534?

Check whether you run Espocrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33534: EspoCRM SSRF via internal-host validation bypass in Attachment API

CVE-2026-33534 · Severity: medium · CVSS 4.3 · Published 2026-04-13

EspoCRM, an open-source Customer Relationship Management (CRM) platform, contains a security flaw that allows logged-in users to bypass internal network protections. By providing specially formatted web addresses, an attacker can force the CRM server to connect to internal services that are normally hidden from the internet. This could lead to the exposure of sensitive internal data or allow the attacker to interact with other private systems within the organization's network.

Technologies: Espocrm. Vendors: Espocrm.

Quick answers

Is CVE-2026-33534 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33534 being exploited in the wild.
How severe is CVE-2026-33534?: Medium severity, with a CVSS score of 4.3, published 13 April 2026.
Which products and versions are affected?: EspoCRM EspoCRM <= 9.3.3.
Is there a fix for CVE-2026-33534?: A patch was published on 2026-03-24: Version 9.3.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33534 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33534?: Check whether you run Espocrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in EspoCRM's HostCheck::isNotInternalHost() function. The component relies on PHP's filter_var with FILTER_VALIDATE_IP, which fails to recognize alternative IPv4 representations like octal notation (e.g., 0177.0.0.1). When such a notation is used, the validation logic falls through to a DNS lookup that returns no records, incorrectly flagging the host as safe. Subsequently, cURL normalizes the address and executes the request to the internal or loopback destination. Attackers can exploit this via the /api/v1/Attachment/fromImageUrl endpoint to reach internal services and save the responses as attachments. The issue is resolved in version 9.3.4.

Affected products

EspoCRM EspoCRM <= 9.3.3

Timeline

2026-03-24: patched: Version 9.3.4 released
2026-04-13: disclosed: Security advisory published
2026-04-13: advisory: CVE-2026-33534 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.