EspoCRM versions 9.3.3 and earlier contain a server‑side request forgery flaw in the POST /api/v1/Attachment/fromImageUrl endpoint. The flaw arises from a DNS rebinding (time‑of‑check to time‑of‑use) condition combined with a mismatch between host validation using dns_get_record() and the actual curl resolver, allowing an authenticated user with attachment‑creation rights to fool the application into resolving a supplied hostname to an internal IP. This permits the attacker to reach internal network hosts, scan ports, and interact with internal HTTP services, though it cannot retrieve binary data or execute code on those hosts. The weakness is reflected by CWE‑367 and CWE‑918.

Affecteds: EspoCRM (espocrm) product, specifically versions 9.3.3 and all prior releases. No other vendors or product versions are listed as impacted.

The CVSS base score of 3.5 indicates low complexity but the exploitable nature is clear: an attacker needs only authenticated access with default attachment‑creation permissions and can use any HTTP client to send a request to the vulnerable endpoint. The EPSS score is not available and the issue is not marked in CISA's KEV, suggesting that widespread exploitation has not yet been observed. Nevertheless, the ability to discover internal network topology remains a significant threat to confidentiality and availability within the affected environment. The vulnerability is resolved in EspoCRM 9.3.4, which eliminates the double‑lookup path by aligning host resolution with validation.