Path Traversal Vulnerability in EspoCRM by EspoCRM

CVE-2026-33733

What is CVE-2026-33733?

EspoCRM, an open source customer relationship management application, contains a vulnerability in the admin template management endpoints that allows authenticated admins to manipulate name and scope values. This can lead to path traversal, enabling the potential for unauthorized reading, creation, overwriting, or deletion of files within the web application's file system. The vulnerability impacts versions prior to 9.3.4, where the issue was resolved, emphasizing the importance of keeping software up-to-date to mitigate security risks.

References