EspoCRM Critical Path Traversal: Admin Access Leads to Server Compromise

The National Vulnerability Database has disclosed CVE-2026-33656, a critical path traversal vulnerability in EspoCRM, an open-source customer relationship management application. Prior to version 9.3.4, a flaw in EspoCRM’s formula scripting engine allowed authenticated administrators to manipulate the sourceId field of Attachment entities. This field, when concatenated directly into file paths without sanitization, enables an attacker to redirect file read or write operations.

This vulnerability, rated 9.1 CVSS (Critical), essentially grants a high-privileged attacker the ability to move or overwrite files within the web server’s open_basedir scope. For defenders, this is a red flag: an attacker who gains administrative access to EspoCRM can leverage this to achieve arbitrary file manipulation, potentially leading to remote code execution or complete server compromise. The attacker’s calculus here is straightforward: elevate a high-privilege access into a full system takeover.

Organizations running EspoCRM must prioritize patching to version 9.3.4 immediately. Given the critical severity and the ease with which an authenticated admin can exploit this, the window for attackers is wide open. This isn’t just about data; it’s about the integrity and availability of your entire web server.