Description
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.
Published: 2026-04-13
Score: 4.3 Medium
EPSS: 2.0% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

EspoCRM versions 9.3.3 and older allow an authenticated user to exploit a Server‑Side Request Forgery by supplying IPv4 addresses in alternative octal notation that bypasses the internal‑host validation logic. The flaw relies on PHP’s filter_var function, which does not recognize alternative IP formats, resulting in the server resolving the address to the loopback host and storing the fetched content as an attachment. This weakness, classified as CWE‑918, enables access to services reachable only from the application’s runtime environment.

Affected Systems

The affected product is EspoCRM, versions 9.3.3 and earlier. The vulnerability is fixed in version 9.3.4. Any installation running a vulnerable release is susceptible until it is upgraded.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, and the vulnerability requires valid authentication to trigger the /api/v1/Attachment/fromImageUrl endpoint, limiting the attack surface. The EPSS score of 2% indicates a low probability of exploitation, and the issue is not listed in CISA’s KEV catalog. An attacker can log into the application, supply a crafted URL using an obfuscated IP address, and force the server to contact internal services over the loopback interface, potentially exposing sensitive data.

Generated by OpenCVE AI on June 18, 2026 at 09:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade EspoCRM to version 9.3.4 or later
  • Restrict or disable the /api/v1/Attachment/fromImageUrl endpoint for non-privileged users
  • Apply network-level controls to limit outbound connections to internal IP ranges from the application server

Generated by OpenCVE AI on June 18, 2026 at 09:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*

Tue, 14 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Espocrm
Espocrm espocrm
Vendors & Products Espocrm
Espocrm espocrm

Mon, 13 Apr 2026 20:00:00 +0000

Type Values Removed Values Added
Description EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.
Title EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Espocrm Espocrm
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-14T16:28:58.299Z

Reserved: 2026-03-20T18:05:11.831Z

Link: CVE-2026-33534

cve-icon Vulnrichment

Updated: 2026-04-14T15:28:11.783Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-13T20:16:33.970

Modified: 2026-06-17T10:37:40.097

Link: CVE-2026-33534

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T09:15:16Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)