EspoCRM Path Traversal: Admin Creds Lead to Arbitrary File Access

The National Vulnerability Database has detailed CVE-2026-33733, a high-severity path traversal vulnerability impacting EspoCRM versions prior to 9.3.4. This flaw allows an authenticated administrator to manipulate name and scope values in template management endpoints. These values are then used in template path construction without proper sanitization, enabling the use of ../ sequences.

Exploiting this, an attacker can escape the intended template directory. This grants them the ability to read, create, overwrite, or delete arbitrary files, specifically body.tpl or subject.tpl, within the web application user’s filesystem permissions. The impact is significant, rated 7.2 CVSS, due to the high confidentiality, integrity, and availability implications once an attacker gains admin-level access.

Defenders running EspoCRM must prioritize patching to version 9.3.4 immediately. While requiring authenticated admin access mitigates some risk, it doesn’t eliminate it. A compromised admin account — whether through phishing, credential stuffing, or insider threat — becomes a critical pivot point for full system compromise. The attacker’s calculus is clear: gain admin, then leverage this path traversal for persistence or further lateral movement.