CVE-2026-59994: EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and renders it without escaping in Email Received stream notification emails sent to users following the related record, allowing HTML injection and, in mail clients that execute it, JavaScript execution. Earlier sanitization for Post and Mention notifications did not cover this notification path. This issue is fixed in version 9.3.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 9.3.9
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
EspoCRM versions before 9.3.9 are affected if they monitor a group or IMAP address, including an email-to-Case address, and send Email Received stream notifications to users following the related record.
What does an attacker need to do to exploit it?
The attacker does not need to authenticate to EspoCRM. They need to send an email to a monitored address with arbitrary HTML in the message's plain-text body; the payload is then included in Email Received notification emails.
Are all stream notification types affected?
The described issue is limited to the Email Received notification path. Existing sanitization for Post and Mention notifications did not cover this path.
What is the available remediation?
Upgrade EspoCRM to version 9.3.9, which fixes the issue.