CVE-2026-63130: EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and delete
EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 9.3.10
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated EspoCRM administrator with access to the administrative Label Manager. It is not described as exploitable by unauthenticated or lower-privileged users.
What files can be affected?
An attacker can target JSON files accessible to the EspoCRM application outside the intended directory. Reading, modifying, creating, or deleting files is constrained by the application's filesystem permissions and server configuration.
Are deployments running the default configuration affected?
The available information does not identify a configuration prerequisite beyond access to the administrative Label Manager and filesystem access to JSON files. Exposure and impact depend on the permissions granted to the application process.
What should be done if an immediate upgrade is not possible?
Restrict administrative access to trusted users and limit the EspoCRM application's filesystem permissions so it cannot access or alter unnecessary JSON files. Upgrade to version 9.3.10 when possible.
How can administrators identify potentially affected systems?
Systems running a version prior to 9.3.10 should be considered affected if administrators can use the Label Manager. Review application and filesystem activity for unexpected JSON file reads, modifications, creation, or deletion outside the intended label directory.