CVE-2026-47168: EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 9.3.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated EspoCRM administrator can exploit it. The attacker must be able to submit crafted serialized PHP object data through MassAction or Export parameters.
Does exploitation require user interaction or a separate trigger?
No user interaction is required. The crafted data is stored in background MassAction or Export parameters and is later deserialized by the application, which can lead to server-side code execution.
What versions are affected and how should it be remediated?
EspoCRM versions prior to 9.3.7 are affected. Upgrade to version 9.3.7, which fixes the unsafe deserialization paths.