CVE-2026-126305: EspoCRM before 10.0.9 Stored XSS via Knowledge Base Article Attachments
EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user needs Knowledge Base create or edit access. They must be able to attach a JavaScript file to a Knowledge Base article and add a crafted link to the article body.
Who is at risk from the stored script?
An administrator is affected when they click the crafted link in the malicious Knowledge Base article. The script then runs in that administrator's session.
What is the potential impact if exploitation succeeds?
The attacker can create an administrator account using credentials of their choice through the compromised administrator session.
Which releases are affected?
Affected releases are versions before 9.3.11 and 10.x versions before 10.0.9.