Live › vulnerability › CVE-2026-113643
Go to dashboardEspoCRM up to 9.3.10 and 10.0.10 has a flaw in the PDF rendering image source provider where a manipulated ID argument skips the authorization check. A remote attacker may be able to read attachments or images they should not have access to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations of EspoCRM 9.3.10 and earlier 9.x releases, and 10.0.10 and earlier 10.x releases, where users can reach the PDF rendering feature. Self-hosted instances that accept logins from the internet are the main concern. Teams on a patched version can skip it.
No product ranges from the sources yet.
version in application/Espo/Resources/defaults.json or the admin panel, and see whether it is 9.3.10 or 10.0.10 or earlier.9.3.10 on the 9.x line, or after 10.0.10 on the 10.x line, or apply the upstream patch 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-113643")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.