CVE-2026-33656 - Vulnerability Analysis

Overview

EspoCRM < 9.3.4 contains a path traversal caused by unsanitized update of attachment's sourceId in formula scripting engine, letting authenticated admin redirect file operations within open_basedir scope.

Severity & Score

Impact

Authenticated admins can overwrite file paths, enabling arbitrary file read/write within web server's restricted directories.

Mitigation

Upgrade to version 9.3.4 or later.

References

• https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x

Social Media Activity(1 post)

/r/netsec

@_r_netsec

Mar 25, 2026

CVE-2026-33656: EspoCRM ≤ 9.3.3 — Formula engine ACL gap + path traversal → authenticated RCE (full write-up + PoC) https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656

View original post

GitHub Repositories(1 repo)

• https://github.com/JivaSecurity/ESPOCRM-RCE-POC-CVE-2026-33656

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner