---
id: "CVE-2026-126306"
page: "https://infrastack.ai/live/CVE-2026-126306"
kind: "vulnerability"
aliases: ["CVE-2026-126306"]
title: "EspoCRM: stored XSS via SVG upload lets attacker act as admin"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "EspoCRM", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["crm", "espocrm", "package", "self-hosted"]
not_affected_if: ["no-untrusted-users", "patched-version"]
published_at: "2026-11-13T10:17:35+00:00"
first_seen_at: "2026-11-13T10:47:15+00:00"
updated_at: "2026-11-13T10:50:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126306", "first_seen_at": "2026-11-13T10:47:15+00:00"}]
exploit_sources: []
---

# EspoCRM: stored XSS via SVG upload lets attacker act as admin

Link for people: https://infrastack.ai/live/CVE-2026-126306 (this .md is for agents)

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 let low-privileged users upload crafted SVG images that run script in the browser of an administrator who opens and clicks them. The injected script can send authenticated requests as that administrator, such as raising the attacker's account to administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EspoCRM affected range not listed fixed no fixed version listed

## How to check

- Check the EspoCRM version in the admin panel or the application's package metadata against `9.3.11` and `10.0.8`
- Look for users with low privileges who can upload attachments or images

## Fix

- EspoCRM `9.3.11` for the 9.x line
- EspoCRM `10.0.8` for the 10.x line

## Timeline

- 2026-11-13T10:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126306

## Documents

- [advisory] Vendor advisory: github.com https://github.com/espocrm/espocrm/security/advisories/GHSA-4qv5-q4g7-hp5r
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/espocrm-before-10.0.8-stored-xss-via-malicious-svg-attachment

## From the sources

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_