CVE-2026-33741 Details
Description
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents through both the attachment and image entry points, resulting in stored cross-user XSS reachable through a normal attachment workflow. Although inline SVG script is blocked by the response CSP, the same CSP still allows same-origin external script. As a result, an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment, then trick another user into opening the SVG to execute JavaScript in the victim's EspoCRM origin. This issue has been fixed in version 9.3.4.
A stored cross-user cross-site scripting vulnerability has been identified in EspoCRM versions through 9.3.3. This issue allows authenticated users to upload SVG files as attachments, which can then execute JavaScript in the context of the user who opens the SVG. The vulnerability arises because the Content Security Policy (CSP) blocks inline scripts in SVGs but permits same-origin external scripts. An attacker can exploit this by uploading a malicious SVG that references an external JavaScript file, then tricking another user into opening the SVG, thereby executing the JavaScript in the victim's EspoCRM session.
Users are advised to update to EspoCRM version 9.3.4 or later. Additionally, do not allow user-uploaded SVG files to be served as active same-origin documents. Consider removing SVG from the allowed image types for attachments, sanitizing SVG files before storage, and implementing a restrictive CSP for SVG responses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/security/advisories/GHSA-5wh5-ccv2-m3pv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-5wh5-ccv2-m3pv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EspoCRM | <= 9.3.3 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |