CVE-2025-52892: EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52892?
CVE-2025-52892 has a high severity rating due to the potential for unauthorized access.
How do I fix CVE-2025-52892?
To fix CVE-2025-52892, upgrade to EspoCRM version 9.1.7 or later.
What versions of EspoCRM are affected by CVE-2025-52892?
EspoCRM versions 9.1.6 and below are affected by CVE-2025-52892.
Can CVE-2025-52892 lead to data exposure?
Yes, CVE-2025-52892 can lead to data exposure if exploited by an attacker.
Is there a workaround for CVE-2025-52892?
A temporary workaround for CVE-2025-52892 is to ensure the webserver strips double slashes from URLs.