CVE-2026-33733 Details
Description
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use `../` sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to `body.tpl` or `subject.tpl` under the web application user's filesystem permissions. Version 9.3.4 fixes the issue.
A path traversal vulnerability has been identified in EspoCRM versions prior to 9.3.4. The issue arises in the admin template management endpoints, which accept user-controlled 'name' and 'scope' values. These values are used to construct file paths without proper sanitization, allowing an authenticated admin to escape the intended template directory using '../' sequences. This exploitation can lead to reading, creating, overwriting, or deleting arbitrary files that correspond to 'body.tpl' or 'subject.tpl' under the user's filesystem permissions.
To address this vulnerability, do not allow user-controlled template identifiers to be concatenated directly into filesystem paths. Implement strict allowlisting for valid template names and scope values, reject path metacharacters before constructing paths, and verify that the final path remains within the intended template root. Apply these validations to both read and write/delete operations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-23 | Relative Path Traversal | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| espocrm espocrm | < 9.3.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |