CVE-2026-55184: EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 9.3.9
Event History
Frequently Asked Questions
Who can exploit this issue, and which users are at risk?
An attacker needs permission to edit Email Templates or PDF Templates in EspoCRM. The payload executes only when another user opens the affected template in edit mode, potentially allowing the attacker to hijack that user's session.
Is a default deployment affected?
Exploitation requires clientCspDisabled to be true. The provided information does not state whether this setting is enabled by default.
What versions are affected and what is the fix?
EspoCRM versions prior to 9.3.9 are affected. Upgrade to version 9.3.9, which fixes the issue.
What can be done before upgrading?
Ensure clientCspDisabled is not true and restrict Email Template and PDF Template edit permission to trusted users. Review templates edited by users with those permissions for crafted HTML.