HTML Injection Vulnerability in EspoCRM by EspoCRM
CVE-2026-55184

3.5LOW

Key Information:

Vendor

Espocrm

Status
Espocrm
Vendor
CVE Published:
15 October 2026

What is CVE-2026-55184?

EspoCRM, an open-source customer relationship management application, has a security vulnerability that allows users with the capability to edit Email or PDF templates to store malicious HTML code. This crafted HTML can bypass the built-in sanitization function, moderateSanitizeHtml(), leading to exploitation. When an unsuspecting user with clientCspDisabled opens the template in edit mode, the malicious payload is executed, which could result in session hijacking. The issue has been resolved in version 9.3.9.

Affected Version(s)

espocrm < 9.3.9

References

https://github.com/espocrm/espocrm/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/espocrm/espocrm/commit/67223bfb82338c0...
x_refsource_MISC
https://github.com/espocrm/espocrm/releases/tag/9.3.9
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.