CVE-2026-63130
Deferred Deferred - Pending Action

Path Traversal in EspoCRM

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-63130
EUVD
EUVD-2026-102108

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm < 9.3.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63130 is a path traversal vulnerability in EspoCRM's Label Manager. An authenticated administrator can exploit insufficient path validation to read, modify, create, or delete JSON files outside the intended directory. This is possible due to improper handling of user-supplied file paths, allowing directory traversal sequences.

Impact Analysis

If you are an EspoCRM administrator running a version prior to 9.3.10, an attacker with admin access could manipulate JSON files to alter application data, delete critical files, or read sensitive information. This could disrupt CRM functionality or expose confidential data, depending on server permissions.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations must ensure proper access controls and apply the patch to maintain compliance.

Mitigation Strategies

Upgrade EspoCRM to version 9.3.10 or later to address the path traversal vulnerability in the Label Manager.

  • Review and restrict administrative access to only trusted users to reduce exposure.
  • Monitor file system changes and unauthorized access attempts in directories where EspoCRM stores JSON files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63130. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart