CVE-2026-33656

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server's `open_basedir` scope. Version 9.3.4 fixes the issue.

• CWE-22

• https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54xExploit, Vendor Advisory
• https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54xExploit, Vendor Advisory

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33649WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33650WWBN AVideo is an open source video platform. In versions up…7.6
• CVE-2026-33651WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33653Ulloady is a file uploader script with multi-file upload sup…5.4
• CVE-2026-33654nanobot is a personal AI assistant. Prior to version 0.1.6, …9.8
• CVE-2026-33655New API is a large language mode (LLM) gateway and artificia…7.7
• CVE-2026-33657EspoCRM is an open source customer relationship management a…5.4
• CVE-2026-33658Active Storage allows users to attach cloud and local files …6.5
• CVE-2026-33659EspoCRM is an open source customer relationship management a…3.1
• CVE-2026-3366IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1…7.5
• CVE-2026-33660n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-33661Pay is an open-source payment SDK extension package for vari…7.5