CVE-2026-53574: EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 9.3.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated EspoCRM user with non-administrator privileges can exploit it. No administrator access or user interaction is required.
Which deployments are affected?
EspoCRM versions from 8.1.0 through 9.3.8 are identified as affected. The vulnerable path is the GET entity streamAttachments endpoint when it processes a crafted where parameter.
What could an attacker gain?
The blind SQL injection can be used to extract arbitrary database information, including active administrator session tokens. Obtaining such tokens can enable full privilege escalation.
What is the remediation?
Upgrade EspoCRM to version 9.3.8, which fixes the issue.