Stored Cross-Site Scripting Vulnerability in EspoCRM
CVE-2026-33741

6.8MEDIUM

Key Information:

Vendor

Espocrm

Status
Espocrm
Vendor
CVE Published:
19 May 2026

What is CVE-2026-33741?

EspoCRM, an open-source customer relationship management tool, has a vulnerability that allows authenticated users to upload SVG files without proper validation. This flaw enables the serving of malicious SVGs as inline documents, which can trigger stored cross-site scripting attacks. Although the Content Security Policy (CSP) blocks inline SVG scripts, it permits same-origin external scripts, allowing attackers to craft harmful SVGs with embedded external JavaScript. Once the malicious SVG is uploaded alongside a JavaScript attachment, unsuspecting users may unknowingly execute the attacker's code upon opening the SVG. This vulnerability affects versions 9.3.3 and below and has been addressed in version 9.3.4.

Affected Version(s)

espocrm < 9.3.4

References

https://github.com/espocrm/espocrm/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.