CVE-2026-126306
Deferred Deferred - Pending Action

Stored XSS in EspoCRM via Malicious SVG Upload

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126306
EUVD
EUVD-2026-125214

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
espocrm espocrm to 9.3.11 (exc)
espocrm espocrm From 10.0.0 (inc) to 10.0.8 (exc)
espocrm espocrm to 10.0.8|end_excluding=9.3.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 have a stored cross-site scripting (XSS) vulnerability. Low-privileged users can upload malicious SVG images that execute authenticated POST requests to backend endpoints when an administrator opens the image in a browser tab and interacts with it. This allows attackers to perform actions like elevating their account to administrator privileges.

Detection Guidance

Check EspoCRM versions for installations below 9.3.11 or 10.x below 10.0.8. Inspect uploaded SVG files for malicious scripts or unusual POST request patterns. Review admin logs for unauthorized privilege changes.

Impact Analysis

This vulnerability allows attackers with low privileges to escalate their access to administrator level by tricking an administrator into opening a malicious SVG file. This could lead to full system compromise, unauthorized data access, or manipulation of sensitive information within EspoCRM.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using vulnerable versions of EspoCRM may face compliance violations, legal penalties, or reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade EspoCRM to version 9.3.11 or 10.0.8 or later immediately. Remove or restrict upload permissions for low-privileged users. Monitor admin accounts for suspicious activity and disable SVG uploads if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...