CVE-2026-33656: EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the sourceId field on Attachment entities. Because sourceId is concatenated directly into a file path with no sanitization in EspoUploadDir::getFilePath(), an attacker can redirect any file read or write operation to an arbitrary path within the web server's openbasedir scope. Version 9.3.4 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33656?
CVE-2026-33656 has been assessed as a critical vulnerability due to its potential for remote code execution.
Who is affected by CVE-2026-33656?
CVE-2026-33656 affects all versions of EspoCRM prior to 9.3.4.
How do I fix CVE-2026-33656?
To fix CVE-2026-33656, upgrade EspoCRM to version 9.3.4 or later.
What kind of attack can be executed through CVE-2026-33656?
CVE-2026-33656 allows authenticated remote code execution via a formula with path traversal in attachment `sourceId`.
Can non-admin users exploit CVE-2026-33656?
No, CVE-2026-33656 can only be exploited by admin users of EspoCRM.