CVE-2026-113643

A vulnerability exists in EspoCRM versions up to 9.3.10/10.0.10 within the PDF Rendering Pipeline component. Specifically, the ImageSourceProvider::get function in the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php fails to properly validate the ID argument. This flaw allows for a...

CVE-2026-113643 EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass...