---
id: "CVE-2026-113643"
kind: "vulnerability"
aliases: ["CVE-2026-113643"]
title: "EspoCRM: PDF image handling lets requests bypass authorization checks"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["espocrm", "package", "php", "self-hosted"]
not_affected_if: ["patched-version"]
published_at: "2026-10-20T19:17:32+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:24:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113643", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# EspoCRM: PDF image handling lets requests bypass authorization checks

EspoCRM up to 9.3.10 and 10.0.10 has a flaw in the PDF rendering image source provider where a manipulated ID argument skips the authorization check. A remote attacker may be able to read attachments or images they should not have access to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed EspoCRM version, for example by reading `version` in `application/Espo/Resources/defaults.json` or the admin panel, and see whether it is `9.3.10` or `10.0.10` or earlier.
- Confirm whether PDF generation (Dompdf) is enabled and used in the deployment.

## Fix

- Move EspoCRM to a release after `9.3.10` on the 9.x line, or after `10.0.10` on the 10.x line, or apply the upstream patch `91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2`.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113643

## From the sources

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_