CVE-2026-88896
Deferred Deferred - Pending Action

Server-Side Request Forgery in EspoCRM

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services. Affected paths include POST /Attachment/fromImageUrl, reachable by any authenticated user with attachment access, and outbound webhook delivery, which requires an admin or API user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88896
EUVD
EUVD-2026-75446

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
espocrm espocrm 10.0.3
espocrm espocrm to 10.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88896 is a Server-Side Request Forgery (SSRF) vulnerability in EspoCRM versions before 10.0.4. The issue occurs in the HostCheck::ipAddressIsNotInternal() function, which fails to properly validate outbound URLs using IPv6 transition addresses like NAT64, 6to4, and Teredo. These addresses embed private IPv4 ranges, allowing attackers to bypass internal-host validation and make EspoCRM send requests to internal network services.

Detection Guidance

To detect this vulnerability, check if your EspoCRM instance is running a version before 10.0.4. Inspect outbound requests to internal services from endpoints like POST /Attachment/fromImageUrl or webhook delivery. Monitor for requests originating from IPv6 transition addresses (NAT64, 6to4, Teredo).

  • Verify EspoCRM version: grep -r "version" /path/to/espocrm/config.php or check admin panel.
  • Inspect DNS AAAA records for domains pointing to IPv6 transition addresses (64:ff9b::, 2002::, 2001::).
  • Check server logs for outbound requests to internal IP ranges from EspoCRM processes.
Impact Analysis

An attacker could exploit this to trick your EspoCRM instance into making unauthorized requests to internal services, potentially accessing sensitive data or internal systems. Authenticated users with attachment access could trigger requests via POST /Attachment/fromImageUrl, while admins or API users could do so via webhooks. This could lead to data leaks or further network compromise.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protecting health information. Organizations using vulnerable EspoCRM versions may face compliance violations if exploited, potentially resulting in legal or regulatory penalties.

Mitigation Strategies

Upgrade EspoCRM to version 10.0.4 or later immediately. Block IPv6 transition addresses (NAT64, 6to4, Teredo) at the network firewall level. Restrict access to sensitive internal services from EspoCRM servers.

  • Apply the official patch from EspoCRM 10.0.4 or higher to fix the HostCheck::ipAddressIsNotInternal() validation.
  • Configure network rules to deny outbound traffic to IPv6 transition address ranges.
  • Review and restrict permissions for users accessing POST /Attachment/fromImageUrl and webhook endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart