A flaw in EspoCRM allows an authenticated administrator to inject malicious PHP objects that the system later deserializes without class restrictions. The vulnerability is a classic unsafe object deserialization problem (CWE‑502) giving the attacker the ability to instantiate arbitrary classes and execute code on the host server. The result is uncontrolled server compromise, enabling the attacker to read, modify, or delete data, or perform further attacks.

The issue is present in all EspoCRM releases prior to 9.3.7. Any installation using those versions with the MassAction or Export background job functionality enabled is at risk. The recommendation is to assess the version in use; only the 9.3.7 release and later versions contain the fix.

The CVSS score of 9.1 indicates high severity, and the EPSS score of less than 1% suggests exploitation is currently unlikely, though the vulnerability is officially unenforced in KEV. Inferred from the description, the attack requires an authenticated administrator account and the ability to submit serialized data to a MassAction or Export parameter. Once submitted, the system deserializes the payload, triggering code execution. If a privileged attacker gains control, they can achieve full remote code execution on the underlying server.