This vulnerability allows an authenticated administrator to provide crafted input to the EspoCRM Label Manager, triggering a path traversal that can read, modify, create, or delete JSON files accessible to the application. The flaw exposes configuration data and permits tampering with application behavior, potentially leading to data loss or corruption. It is classified as a CWE-22 path traversal weakness that compromises the integrity and confidentiality of the affected files.

EspoCRM installations prior to version 9.3.10 are impacted. The flaw resides in the Label Manager of the administration interface and affects all deployments that allow administrator login, irrespective of server size or setup.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the near term. The flaw is not listed in the CISA KEV catalog. Since the attack requires authenticated administrative access, the attack vector is internal; however, once an admin credential is compromised the attacker can manipulate any JSON files within the application’s scope.