Stored XSS in EspoCRM Knowledge Base Articles

Executive Summary

CVE-2026-126305 is a stored cross-site scripting (XSS) vulnerability in EspoCRM versions before 9.3.11 and 10.x before 10.0.9. It allows users with Knowledge Base create or edit access to attach a JavaScript file and insert a malicious link into an article. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect EspoCRM Knowledge Base articles for suspicious JavaScript file attachments or crafted links. Check for unauthorized administrator account creations in logs. Review user permissions for Knowledge Base edit access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to full account compromise and potential system takeover. An attacker could create a new administrator account with arbitrary credentials, gaining full control over the EspoCRM instance. This requires user interaction (clicking a link) but can result in unauthorized access and data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade EspoCRM to version 10.0.9 or later, or 9.3.11 or later. Remove any unauthorized administrator accounts. Restrict Knowledge Base edit permissions to trusted users. Monitor for suspicious activity in logs.

Useful 0 Not Useful 0