Executive brief
EspoCRM is an open-source platform used by businesses to manage customer relationships and sales data. A security flaw allows an authenticated user to upload malicious files that, when opened by another user, can execute unauthorized code in their browser. This could allow an attacker to steal sensitive customer information, hijack user sessions, or perform actions on behalf of other employees or administrators.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in EspoCRM versions <= 9.3.3 due to improper handling of SVG uploads and a permissive Content Security Policy (CSP). While the application's CSP (default-src 'self') blocks inline scripts within SVGs, it fails to define a restrictive script-src, thereby allowing the execution of external scripts from the same origin. An attacker can exploit this by uploading a malicious JavaScript file as a standard attachment and then uploading an SVG that references that script via the 'entryPoint=download' URL. When a victim views the SVG through the attachment or image entry points, the browser renders it as a top-level document and executes the attacker's script within the EspoCRM origin. This issue is fixed in version 9.3.4.
Affected products
- EspoCRM EspoCRM <= 9.3.3
Timeline
- 2026-05-08: advisory: Vendor advisory published on GitHub
- 2026-05-19: disclosed: CVE published to NVD