CVE-2026-126306: EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
A low-privileged EspoCRM user can upload a crafted SVG image. Exploitation requires an administrator to open that SVG in a separate browser tab and click it.
What can an attacker do after the administrator interacts with the SVG?
The SVG can cause authenticated POST requests to arbitrary backend endpoints using the administrator's session. This can enable administrator-level actions, including elevating the attacker's account to administrator.
Which releases are affected?
EspoCRM versions before 9.3.11 are affected, as are 10.x versions before 10.0.8.