CVE-2026-33656 - Vulnerability Analysis

Overview

EspoCRM < 9.3.4 contains a path traversal caused by unsanitized update of attachment's sourceId in formula scripting engine, letting authenticated admin redirect file operations within open_basedir scope.

Severity & Score

Impact

Authenticated admins can overwrite file paths, enabling arbitrary file read/write within web server's restricted directories.

Mitigation

Upgrade to version 9.3.4 or later.

References

• https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 22, 2026

🔴 CVE-2026-33656 - Critical (9.1) EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` fi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33656/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

GitHub Repositories(1 repo)

• https://github.com/JivaSecurity/ESPOCRM-RCE-POC-CVE-2026-33656

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner