Server-Side Request Forgery in EspoCRM by Espo Technologies
CVE-2026-33534
Key Information:
Badges
What is CVE-2026-33534?
EspoCRM versions 9.3.3 and earlier exhibit a vulnerability that enables Server-Side Request Forgery (SSRF). This flaw arises from the HostCheck::isNotInternalHost() function, which inadequately verifies host addresses, particularly when alternative IPv4 representations are used. Attackers can exploit this weakness through the /api/v1/Attachment/fromImageUrl endpoint, allowing authenticated users to compel the server to access loopback services. Although the validation mechanism employs PHP's filter_var, it fails to recognize certain IP formats, which can lead to unauthorized disclosure of internal resources. This issue has been rectified in version 9.3.4.
Affected Version(s)
espocrm < 9.3.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.