CVE-2026-88896 Details
Description
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services. Affected paths include POST /Attachment/fromImageUrl, reachable by any authenticated user with attachment access, and outbound webhook delivery, which requires an admin or API user.
A server-side request forgery (SSRF) vulnerability has been identified in EspoCRM versions prior to 10.0.4. The issue arises in the HostCheck::ipAddressIsNotInternal() function, which is supposed to validate outbound URLs and block requests to internal or private IP addresses. While the function correctly strips IPv4-mapped IPv6 prefixes, it fails to recognize certain IPv6 transition addresses that contain private IPv4 information, specifically NAT64, 6to4, and Teredo addresses. An attacker controlling a domain with AAAA records pointing to these transition addresses can exploit this oversight, bypassing internal-host validation and IP-pinning checks, and causing EspoCRM to make outbound requests to internal network services. This vulnerability affects the POST /Attachment/fromImageUrl endpoint, accessible to any authenticated user with attachment rights, as well as outbound webhook deliveries, which require an admin or API user.
Users can upgrade to EspoCRM version 10.0.4 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EspoCRM | <= 10.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |