CVE-2026-33534 Details
Description
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.
A server-side request forgery (SSRF) vulnerability has been identified in EspoCRM versions 9.3.3 and prior. This vulnerability allows authenticated users to bypass internal host validation by using alternative IPv4 representations, such as octal notation. The issue arises because the validation function relies on PHP's filter_var to validate IP addresses, which does not recognize these alternative formats. As a result, the validation incorrectly allows requests to loopback-only services, potentially accessing internal resources from the application runtime. The vulnerability has been confirmed in the '/api/v1/Attachment/fromImageUrl' endpoint, where the fetched response can be stored as an attachment.
Users can upgrade to EspoCRM version 9.3.4, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/security/advisories/GHSA-h7gx-8gwv-7g73 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/espocrm/espocrm/releases/tag/9.3.4 | [email protected] | Release Notes |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-h7gx-8gwv-7g73 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| espocrm espocrm | < 9.3.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | New CVE Received | [email protected] |