CVE-2026-59994 Details
Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and renders it without escaping in Email Received stream notification emails sent to users following the related record, allowing HTML injection and, in mail clients that execute it, JavaScript execution. Earlier sanitization for Post and Mention notifications did not cover this notification path. This issue is fixed in version 9.3.9.
A stored HTML injection vulnerability has been identified in EspoCRM versions prior to 9.3.9. This issue allows an unauthenticated remote attacker to inject arbitrary HTML, and potentially executable JavaScript, into the 'Email Received' stream notification emails. The vulnerability arises because EspoCRM renders the email body without proper escaping, following the receipt of an email sent to a monitored group or IMAP address, including an email-to-Case address. The injected content is then delivered to users associated with the related record. This vulnerability was not present in the 'Post' and 'Mention' notification paths, which had received prior sanitization.
Users can upgrade to EspoCRM version 9.3.9 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/commit/f9fd47622df04617728643b4b8f1a22563cbc6e7 | [email protected] | Source CodeVendor |
| https://github.com/espocrm/espocrm/releases/tag/9.3.9 | [email protected] | Release NotesVendor |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-3rh4-9hcq-g79m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EspoCRM | <= 9.3.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |