{"id":"CVE-2026-126306","kind":"vulnerability","aliases":["CVE-2026-126306"],"related":[],"title":"EspoCRM: stored XSS via SVG upload lets attacker act as admin","description":"EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator.","summary":"EspoCRM versions before 9.3.11 and 10.x before 10.0.8 let low-privileged users upload crafted SVG images that run script in the browser of an administrator who opens and clicks them. The injected script can send authenticated requests as that administrator, such as raising the attacker's account to administrator.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EspoCRM","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["crm","espocrm","package","self-hosted"],"not_affected_if":["no-untrusted-users","patched-version"],"how_to_check":"- Check the EspoCRM version in the admin panel or the application's package metadata against `9.3.11` and `10.0.8`\n- Look for users with low privileges who can upload attachments or images","fix":"- EspoCRM `9.3.11` for the 9.x line\n- EspoCRM `10.0.8` for the 10.x line","status":"open","published_at":"2026-11-13T10:17:35+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","triaged_at":"2026-11-13T10:50:52+00:00","updated_at":"2026-11-13T10:50:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:50:52Z","model":"claude-haiku-5-5","output":{"fix":"- EspoCRM `9.3.11` for the 9.x line\n- EspoCRM `10.0.8` for the 10.x line","reach":"internet","title":"EspoCRM: stored XSS via SVG upload lets attacker act as admin","impact":"high","summary":"EspoCRM versions before 9.3.11 and 10.x before 10.0.8 let low-privileged users upload crafted SVG images that run script in the browser of an administrator who opens and clicks them. The injected script can send authenticated requests as that administrator, such as raising the attacker's account to administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["espocrm","self-hosted","crm"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Administrator session abused to take over the CRM account","analyst_note":"","how_to_check":"- Check the EspoCRM version in the admin panel or the application's package metadata against `9.3.11` and `10.0.8`\n- Look for users with low privileges who can upload attachments or images","plain_action":"","product_name":"EspoCRM","needs_analyst":false,"not_affected_if":["patched-version","no-untrusted-users"],"who_is_affected":"Any EspoCRM installation older than the fixed versions where users can upload files and administrators view them in a browser. Exposure depends on low-privileged accounts existing and an administrator being tricked into opening the SVG. Installations already on the fixed versions are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4644,"output_tokens":564,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126306':14A,17A '-2026':13A,16A '10':30B,80C '10.0.8':33B,83C '9.3.11':28B,78C 'account':73B,138C 'act':9A 'action':131C 'admin':11A 'administr':51B,66B,75B,116C,130C,140C 'allow':93C 'arbitrari':109C 'attack':8A,71B,112C,136C 'authent':62B,105C 'backend':110C 'browser':48B,124C 'click':55B,127C 'contain':84C 'craft':40B,100C 'crm':19B 'cross':88C 'cross-sit':87C 'cve':12A,15A 'elev':134C 'endpoint':111C 'espocrm':1A,18A,20B,25B,76C 'host':24B 'imag':42B,102C 'inject':58B 'let':7A,34B 'low':36B,95C 'low-privileg':35B,94C 'open':53B,118C 'packag':21B 'perform':129C 'post':106C 'privileg':37B,96C 'rais':69B 'request':63B,107C 'run':44B 'script':45B,59B,90C 'self':23B 'self-host':22B 'send':61B 'separ':123C 'site':89C 'store':2A,86C 'submit':104C 'svg':5A,41B,101C,120C 'tab':125C 'trick':114C 'upload':6A,39B,99C 'user':38B,97C 'version':26B 'via':4A 'vulner':91C 'x':31B,81C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Any EspoCRM installation older than the fixed versions where users can upload files and administrators view them in a browser. Exposure depends on low-privileged accounts existing and an administrator being tricked into opening the SVG. Installations already on the fixed versions are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["espocrm"],"ptokens":["espocrm"],"labels":["crm","espocrm","high","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126306':14A,17A '-2026':13A,16A 'act':9A 'admin':11A 'attack':8A 'cve':12A,15A 'espocrm':1A,18A 'let':7A 'store':2A 'svg':5A 'upload':6A 'via':4A 'xss':3A","search_b":"'10':30B '10.0.8':33B '9.3.11':28B 'account':73B 'administr':51B,66B,75B 'attack':71B 'authent':62B 'browser':48B 'click':55B 'craft':40B 'crm':19B 'espocrm':20B,25B 'host':24B 'imag':42B 'inject':58B 'let':34B 'low':36B 'low-privileg':35B 'open':53B 'packag':21B 'privileg':37B 'rais':69B 'request':63B 'run':44B 'script':45B,59B 'self':23B 'self-host':22B 'send':61B 'svg':41B 'upload':39B 'user':38B 'version':26B 'x':31B","search_c":"'10':80C '10.0.8':83C '9.3.11':78C 'account':138C 'action':131C 'administr':116C,130C,140C 'allow':93C 'arbitrari':109C 'attack':112C,136C 'authent':105C 'backend':110C 'browser':124C 'click':127C 'contain':84C 'craft':100C 'cross':88C 'cross-sit':87C 'elev':134C 'endpoint':111C 'espocrm':76C 'imag':102C 'low':95C 'low-privileg':94C 'open':118C 'perform':129C 'post':106C 'privileg':96C 'request':107C 'script':90C 'separ':123C 'site':89C 'store':86C 'submit':104C 'svg':101C,120C 'tab':125C 'trick':114C 'upload':99C 'user':97C 'vulner':91C 'x':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T08:34:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126306","severity":null,"published_at":"2026-11-13T10:17:35+00:00","modified_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","fetched_at":"2026-11-13T10:47:15+00:00","note":null}],"documents":[{"id":144941,"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-4qv5-q4g7-hp5r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T08:34:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144942,"url":"https://www.vulncheck.com/advisories/espocrm-before-10.0.8-stored-xss-via-malicious-svg-attachment","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}