CVE-2026-113643: EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Patch 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2
Event History
Frequently Asked Questions
Which deployments are affected?
EspoCRM versions up to 9.3.10 and 10.0.10 are affected.
What access does an attacker need to exploit this issue?
The attack can be initiated remotely, but the CVSS vector indicates that the attacker requires low privileges. Exploitation involves manipulating an ID argument.
What should be done to remediate the issue?
Install the patch identified as 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2.