CVE-2026-33741

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents through both the attachment and image entry points, resulting in stored cross-user XSS reachable through a normal attachment workflow. Although inline SVG script is blocked by the response CSP, the same CSP still allows same-origin external script. As a result, an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment, then trick another user into opening the SVG to execute JavaScript in the victim's EspoCRM origin. This issue has been fixed in version 9.3.4.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/espocrm/espocrm/security/advisories/GHSA-5wh5-ccv2-m3pv
https://github.com/espocrm/espocrm/security/advisories/GHSA-5wh5-ccv2-m3pv

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-19 19:16

Updated : 2026-07-24 09:10

NVD link : CVE-2026-33741

Mitre link : CVE-2026-33741

CVE.ORG link : CVE-2026-33741

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-33741", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33741", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T14:00:58.399359Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "espocrm", "product": "espocrm", "versions": [{"status": "affected", "version": "< 9.3.4"}]}]}], "published": "2026-05-19T19:16:49.463", "references": [{"url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-5wh5-ccv2-m3pv", "source": "security-advisories@github.com"}, {"url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-5wh5-ccv2-m3pv", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents through both the attachment and image entry points, resulting in stored cross-user XSS reachable through a normal attachment workflow. Although inline SVG script is blocked by the response CSP, the same CSP still allows same-origin external script. As a result, an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment, then trick another user into opening the SVG to execute JavaScript in the victim's EspoCRM origin. This issue has been fixed in version 9.3.4."}, {"lang": "es", "value": "EspoCRM es una aplicaci\u00f3n de gesti\u00f3n de relaciones con clientes de c\u00f3digo abierto. Las versiones 9.3.3 e inferiores permiten a los usuarios autenticados subir archivos SVG adjuntos a trav\u00e9s de campos normales que admiten adjuntos y posteriormente servir esos archivos SVG como documentos en l\u00ednea de nivel superior a trav\u00e9s de los puntos de entrada de adjuntos e im\u00e1genes, lo que resulta en un XSS almacenado entre usuarios accesible a trav\u00e9s de un flujo de trabajo de adjuntos normal. Aunque el script SVG en l\u00ednea es bloqueado por la CSP de respuesta, la misma CSP a\u00fan permite scripts externos del mismo origen. Como resultado, un atacante puede subir un SVG malicioso junto con un segundo archivo JavaScript adjunto controlado por el atacante, luego enga\u00f1ar a otro usuario para que abra el SVG para ejecutar JavaScript en el origen de EspoCRM de la v\u00edctima. Este problema ha sido solucionado en la versi\u00f3n 9.3.4."}], "lastModified": "2026-07-24T09:10:00.153", "sourceIdentifier": "security-advisories@github.com"}