ESPOCRM · CVE-2026-126306 · Package
NO FIX YET · SEE WHAT TO DO
EspoCRM versions before 9.3.11 and 10.x before 10.0.8 let low-privileged users upload crafted SVG images that run script in the browser of an administrator who opens and clicks them. The injected script can send authenticated requests as that administrator, such as raising the attacker's account to administrator.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any EspoCRM installation older than the fixed versions where users can upload files and administrators view them in a browser. Exposure depends on low-privileged accounts existing and an administrator being tricked into opening the SVG. Installations already on the fixed versions are not affected.
Not affected if no-untrusted-users, patched-version
Who cares crm, espocrm, self-hosted
9.3.11 and 10.0.89.3.11 for the 9.x line10.0.8 for the 10.x lineEspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.