HTML Injection Vulnerability in EspoCRM by EspoCRM
CVE-2026-59994

4.3MEDIUM

Key Information:

Vendor

Espocrm

Status
Espocrm
Vendor
CVE Published:
15 October 2026

What is CVE-2026-59994?

EspoCRM, an open-source customer relationship management application, contains a vulnerability that allows unauthenticated remote attackers to exploit email functionalities. By sending crafted emails to a monitored IMAP address, including email-to-Case addresses, attackers can inject arbitrary HTML into the email content. This unsanitized HTML is later rendered in notification emails, potentially enabling JavaScript execution in mail clients that support it. This vulnerability was addressed in version 9.3.9, which introduced enhanced sanitization measures to cover this previously overlooked notification pathway.

Affected Version(s)

espocrm < 9.3.9

References

https://github.com/espocrm/espocrm/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/espocrm/espocrm/commit/f9fd47622df0461...
x_refsource_MISC
https://github.com/espocrm/espocrm/releases/tag/9.3.9
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.