CVE-2025-32390: EspoCRM Knowledge Base XSS Vulnerability

CVE-2025-32390 Overview

CVE-2025-32390 is an HTML injection vulnerability in EspoCRM, a free, open-source customer relationship management platform. Versions prior to 9.0.8 allow authenticated users to inject malicious HTML into Knowledge Base (KB) articles. The injected content can deface the page and imitate the EspoCRM login screen. When victims submit their credentials to the spoofed form, attackers capture them in plain text. The root cause is overly permissive HTML editing on KB articles. The vulnerability impacts any authenticated user with privileges to read KB articles. In enterprises running multiple applications, attackers can craft KB articles that mimic the login pages of other systems, expanding the credential harvesting surface.

Critical Impact
Authenticated attackers can deface Knowledge Base articles, impersonate login pages, and harvest credentials in plain text from any user with read access to KB content.

Affected Products

EspoCRM versions prior to 9.0.8
Self-hosted EspoCRM deployments with Knowledge Base enabled
Multi-application enterprise environments using EspoCRM for KB content

Discovery Timeline

2025-05-12 - CVE-2025-32390 published to NVD
2025-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32390

Vulnerability Analysis

The vulnerability resides in the Knowledge Base article editing functionality of EspoCRM. The application accepts overly permissive HTML markup in KB article content without enforcing strict sanitization. Authenticated users with edit rights to KB articles can embed arbitrary HTML, including full-page replacement markup, form elements, and styling. When other authenticated users browse to the article, the injected HTML renders within the application context and can completely overwrite the visible page.

The weakness is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component. Because the injected content executes inside an authenticated EspoCRM session, victims have no obvious indicator that the rendered login page is malicious. Submitted credentials are sent to an attacker-controlled endpoint defined in the injected form action.

Root Cause

The HTML editor used for KB articles permits a broad set of tags and attributes without restricting structural elements such as <form>, <input>, <style>, and full-page layout markup. EspoCRM did not apply a content security policy or output encoding strict enough to neutralize injected page-replacement payloads before rendering them to other authenticated users.

Attack Vector

An attacker first obtains an authenticated account with privileges to create or edit KB articles. The attacker then publishes a KB article containing HTML that visually replicates the EspoCRM login page or the login page of another corporate application. When a victim with read access to KB articles opens the article, the spoofed login form is rendered. Credentials entered into the form are exfiltrated to an attacker-controlled URL specified in the form action attribute. The attack requires user interaction (UI:A) and low privileges (PR:L) but operates over the network against any reachable EspoCRM instance.

No public proof-of-concept code is available. See the GitHub Security Advisory GHSA-qrwp-v8v3-hqp2 for vendor technical details.

Detection Methods for CVE-2025-32390

Indicators of Compromise

KB articles containing <form>, <input type="password">, or <style> tags that override application layout
Outbound HTTP POST requests originating from EspoCRM page contexts to unexpected external domains
Unusual KB article edits performed by accounts that do not typically author content
User reports of being prompted to log in again while already authenticated to EspoCRM

Detection Strategies

Review the KB article audit log for recent edits and inspect article HTML for embedded form elements or full-page layout tags
Inspect web server access logs for KB article views immediately followed by POST requests to external hosts
Scan stored KB article content for keywords such as password, login, action=http, and inline style blocks that hide native UI

Monitoring Recommendations

Enable detailed audit logging on KB article create and update events and forward logs to a centralized SIEM
Alert on KB articles whose HTML payload exceeds typical content length or contains form elements
Monitor authentication failure spikes across federated applications that may indicate harvested credentials being tested

How to Mitigate CVE-2025-32390

Immediate Actions Required

Upgrade EspoCRM to version 9.0.8 or later, which contains the official patch
Audit existing KB articles for embedded HTML forms, password inputs, or full-page style overrides and remove malicious content
Restrict KB article edit privileges to a minimal set of trusted users until the upgrade is complete
Force password resets for any users who may have submitted credentials to a suspicious KB article

Patch Information

EspoCRM version 9.0.8 contains the fix for CVE-2025-32390. The vendor commit is available at EspoCRM patch commit 6b58d30. Full advisory details are published in the GitHub Security Advisory GHSA-qrwp-v8v3-hqp2.

Workarounds

Temporarily revoke the KB article edit role from non-essential users until patching is complete
Disable the Knowledge Base module if it is not actively used in the deployment
Deploy a web application firewall rule that strips <form>, <input>, and <style> tags from KB article submissions
Communicate to users that EspoCRM will not re-prompt for credentials within a KB article and to report any such prompts

bash

# Configuration example: upgrade EspoCRM via the built-in upgrade command
php command.php upgrade 9.0.8

# Verify the installed version after upgrade
php command.php version