2 matches found
EUVD-2026-25081
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the sourceId field on Attachment entities. Because sourceId is...
9.1CVSS5.8AI score0.00603EPSS
SaveExploits3References1
CVE-2026-33656: Improper Limitation of a Pathname to a Restricted Directory
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the sourceId field on Attachment entities. Because sourceId is...
9.1CVSS6AI score0.00603EPSS
SaveExploits3References4
20