# CVE-2026-88896: EspoCRM server-side request forgery via IPv6 transition address bypass

Source: https://junglewise.ai/threats/cve-2026-88896-espocrm-server-side-request-forgery-via-ipv6-transition-address  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88896 · Severity: medium · CVSS 5.3 · Published 2026-09-10

EspoCRM is a customer relationship management system used to manage business interactions and data. The application contains a flaw in its outbound URL validation that allows attackers to bypass internal-network protections by using IPv6 transition addresses. An authenticated attacker can exploit this through image attachment uploads or webhook delivery to cause the server to make requests to internal services, potentially exposing sensitive data or causing operational disruption.

Technologies: [Espocrm](https://junglewise.ai/threats/technologies/espocrm). Vendors: [Espocrm](https://junglewise.ai/threats/vendors/espocrm).

## Quick answers

**Is CVE-2026-88896 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88896 being exploited in the wild.

**How severe is CVE-2026-88896?** Medium severity, with a CVSS score of 5.3, published 10 September 2026.

**Which products and versions are affected?** Espocrm before 10.0.4.

**Is there a fix for CVE-2026-88896?** A patch was published on 2026-08-13: Fix available in version 10.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88896 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88896?** Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) flaw in the HostCheck::ipAddressIsNotInternal() validation function. The function strips IPv4-mapped IPv6 prefixes (::ffff:) but fails to recognize IPv6 transition addresses (NAT64, 6to4, Teredo) that embed private IPv4 addresses. An attacker controlling a domain with AAAA DNS records pointing to these transition addresses can bypass both the internal-host validation and CURLOPT_RESOLVE IP-pinning checks. This allows EspoCRM to issue outbound requests to internal network services. Exploitation requires authentication with attachment access for POST /Attachment/fromImageUrl, or admin/API credentials for webhook delivery. The issue is patched in EspoCRM 10.0.4.

## Affected products

- EspoCRM EspoCRM before 10.0.4

## Timeline

- 2026-08-13: disclosed: GitHub Security Advisory published
- 2026-09-10: advisory: CVE-2026-88896 published
- 2026-08-13: patched: Fix available in version 10.0.4

## References

- [https://github.com/espocrm/espocrm/security/advisories/GHSA-xwmh-j8hf-cfqw](https://github.com/espocrm/espocrm/security/advisories/GHSA-xwmh-j8hf-cfqw)
- [https://www.vulncheck.com/advisories/espocrm-before-10.0.4-ssrf-via-ipv6-transition-address-bypass](https://www.vulncheck.com/advisories/espocrm-before-10.0.4-ssrf-via-ipv6-transition-address-bypass)

## Related threats

- [EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial)
- [EspoCRM authorization bypass in PDF image rendering](https://junglewise.ai/threats/cve-2026-113643-a-vulnerability-was-found-in-espocrm-up-to-9-3-10-10-0-10-this)
- [EspoCRM mass-update attachment access control bypass](https://junglewise.ai/threats/cve-2026-75505-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-59994-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM CSV/XLSX formula injection via whitespace bypass](https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management)