The vulnerability allows an authenticated user to upload an SVG file that contains a script with the same origin. When a victim opens the attachment, the script executes in the context of the victim’s EspoCRM session, giving the attacker the ability to read cookies, modify page content, or perform any action that the victim’s role permits. The Stored XSS can directly compromise confidentiality, integrity, and availability of the user’s data within the application.

EspoCRM is affected. All releases with version 9.3.3 or lower are impacted; the issue is resolved starting with version 9.3.4.

The CVSS score of 6.8 indicates a moderate risk, and the lack of an EPSS score suggests no known high exploitation probability at this time. The vulnerability is not listed in CISA KEV. Attackers would need to be authenticated to the system and simulate a normal attachment upload, then entice a separate, unsuspecting user to open the crafted SVG. The same‑origin CSP permits the malicious script to run, making the exploitation path straightforward for an internal attacker with sufficient motivation.