Stored HTML Injection Vulnerability in EspoCRM by EspoCRM Team
CVE-2026-33657
Key Information:
Badges
What is CVE-2026-33657?
EspoCRM, an open source customer relationship management application, is vulnerable to a stored HTML injection. This vulnerability affects versions 9.3.3 and earlier, allowing authenticated users with standard privileges to inject malicious HTML code into system-generated email notifications. The issue arises from the use of unescaped triple-brace syntax in Handlebars templates combined with default inline HTML preservation in the Markdown processor. As a result, attacker-controlled HTML can be stored and rendered directly in emails, leading to potential phishing attacks and the ability to manipulate the user interface within the email content. The vulnerability also enables targeted delivery of malicious emails through the @mention feature, making it a significant concern for users receiving system emails. The issue has been addressed in version 9.3.4.
Affected Version(s)
espocrm < 9.3.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.