ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM = 9.3.3 CVE-2026-33656 — RCE autenticado mediante bypass de ACL en Fórmulas + Path Traversal en sourceId de Adjuntos + Envenenamiento de .htaccess Autor : Jiva jivasecurity.com Writeup : https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656 Producto : EspoCRM = 9.3.3 Auth : Se...

📄 EspoCRM 9.3.3 Remote Code Execution / Path Traversal

EspoCRM versions 9.3.3 and below proof of concept remote code execution exploit that leverages formula ACL bypass, path traversal, and poisoning. !/bin/bash =========================================================================== EspoCRM command Example: ./poc.sh http://192.168.5.16:8090 admin...