CVE-2026-55184

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.

• CWE-79

• https://github.com/espocrm/espocrm/commit/67223bfb82338c030f38dac03f12c73b7b3d760f
• https://github.com/espocrm/espocrm/releases/tag/9.3.9
• https://github.com/espocrm/espocrm/security/advisories/GHSA-x5p5-8mxj-9wv6

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55178GeoLens is a self-hosted geospatial data catalog with semant…7.5
• CVE-2026-55179Joplin is an open source note-taking and to-do application t…6.5
• CVE-2026-55180pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…6.5
• CVE-2026-55181Tugtainer is a self-hosted app for automating updates of Doc…9.4
• CVE-2026-55182LibreNMS is a network monitoring system. In versions from 21…8.6
• CVE-2026-55183RClone Manager is a cross-platform GUI application designed …9.6
• CVE-2026-55185Miniflux 2 is an open source feed reader. Prior to 2.3.1, Is…5.1
• CVE-2026-55187Mailpit is an email testing tool and API for developers. Pri…5.8
• CVE-2026-55188RustFS is a distributed object storage system built in Rust.…8.2
• CVE-2026-55189RustFS is a distributed object storage system built in Rust.…7.7
• CVE-2026-55190Event Schedule is an open-source platform to share events, s…6.5
• CVE-2026-55191FreeRDP is a free implementation of the Remote Desktop Proto…9.8