Description
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.
Published: 2026-04-13
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authenticated internal SSRF that can expose loopback services and internal resources
Action: Patch Immediately
AI Analysis

Impact

EspoCRM versions 9.3.3 and older allow an authenticated user to exploit a Server‑Side Request Forgery by supplying IPv4 addresses in alternative octal notation that bypasses the internal‑host validation logic. The flaw relies on PHP’s filter_var function, which does not recognize alternative IP formats, resulting in the server resolving the address to the loopback host and storing the fetched content as an attachment. This weakness, classified as CWE‑918, enables access to services reachable only from the application’s runtime environment.

Affected Systems

The affected product is EspoCRM, versions 9.3.3 and earlier. The vulnerability is fixed in version 9.3.4. Any installation running a vulnerable release is susceptible until it is upgraded.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, and the vulnerability requires valid authentication to trigger the /api/v1/Attachment/fromImageUrl endpoint, limiting the attack surface. EPSS data are not available, and the issue is not listed in CISA’s KEV catalog. An attacker can log into the application, supply a crafted URL using an obfuscated IP address, and force the server to contact internal services over the loopback interface, potentially exposing sensitive data.

Generated by OpenCVE AI on April 13, 2026 at 21:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade EspoCRM to version 9.3.4 or later

Generated by OpenCVE AI on April 13, 2026 at 21:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Espocrm
Espocrm espocrm
Vendors & Products Espocrm
Espocrm espocrm

Mon, 13 Apr 2026 20:00:00 +0000

Type Values Removed Values Added
Description EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.
Title EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Espocrm Espocrm
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-14T16:28:58.299Z

Reserved: 2026-03-20T18:05:11.831Z

Link: CVE-2026-33534

cve-icon Vulnrichment

Updated: 2026-04-14T15:28:11.783Z

cve-icon NVD

Status : Received

Published: 2026-04-13T20:16:33.970

Modified: 2026-04-14T17:16:50.630

Link: CVE-2026-33534

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-14T16:33:28Z

Weaknesses