CVE-2026-55184
Deferred Deferred - Pending Action

Stored XSS in EspoCRM via Email/PDF Templates

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-55184
EUVD
EUVD-2026-102104

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm < 9.3.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in EspoCRM affecting versions 9.3.8 and earlier. A user with Email or PDF Template edit permissions can inject malicious HTML that bypasses the HTML sanitizer. When another user opens the template in edit mode with CSP disabled, the payload executes, potentially hijacking the user's session.

Detection Guidance

Check EspoCRM version with: grep -r "version" config.php. If version is 9.3.8 or earlier, the system is vulnerable. Inspect template edit permissions for users with Email or PDF Template access. Look for unusual HTML or JavaScript in saved templates.

Impact Analysis

An attacker could steal session cookies or sensitive data, perform actions on behalf of the user, or redirect them to malicious sites. This requires the attacker to have template edit permissions and CSP to be disabled on the victim's client.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable versions may face compliance risks if exploited.

Mitigation Strategies

Upgrade EspoCRM to version 9.3.9 or later immediately. Ensure Content Security Policy (CSP) is enabled by default. Review and remove suspicious HTML/JavaScript from existing templates. Restrict template edit permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart