CVE-2026-63130 Details
Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10.
A path traversal vulnerability has been identified in EspoCRM versions prior to 9.3.10. This issue allows authenticated administrators to send crafted input to the Label Manager, leading to unauthorized file operations on JSON files accessible to the application. The vulnerability arises from insufficient path validation, which permits traversal outside the intended directory. Exploitation of this vulnerability could result in reading, modifying, creating, or deleting JSON files, depending on filesystem permissions and server configuration.
Users can upgrade to EspoCRM version 9.3.10 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espocrm/espocrm/commit/31540a04ca8ea96519c7dbf2d8d2273218e69ce6 | [email protected] | Source CodeVendor |
| https://github.com/espocrm/espocrm/releases/tag/9.3.10 | [email protected] | Release NotesVendor |
| https://github.com/espocrm/espocrm/security/advisories/GHSA-jr5q-25fw-27f8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EspoCRM | <= 9.3.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |