CVE-2026-47168
Deferred Deferred - Pending Action

Authenticated PHP Object Injection in EspoCRM

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-47168
EUVD
EUVD-2026-102096

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm < 9.3.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure deserialization flaw in EspoCRM versions before 9.3.7. An authenticated administrator can inject crafted serialized PHP objects into MassAction or Export parameters. When these objects are later deserialized by the application, the lack of class restrictions allows arbitrary object instantiation and remote code execution on the server.

Detection Guidance

Check EspoCRM version with: grep -r "version" config.php. If version is below 9.3.7, the system is vulnerable. Inspect MassAction and Export parameters for serialized data in logs or database. Look for unusual serialized strings in background job logs or export requests.

Impact Analysis

If exploited, this vulnerability allows an attacker with administrator access to execute arbitrary code on the server running EspoCRM. This could lead to full system compromise, data theft, or unauthorized modifications to the CRM system and its data.

Compliance Impact

This vulnerability could lead to unauthorized access and exfiltration of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade EspoCRM to version 9.3.7 or later immediately. Review and restrict administrator access to only trusted users. Monitor for suspicious serialized data in MassAction or Export parameters. Apply input validation for serialized data in all parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart