CVE-2025-52892: EspoCRM Denial of Service Vulnerability

CVE-2025-52892 Overview

CVE-2025-52892 affects EspoCRM, an open-source web application built as a single-page frontend with a PHP-based REST API backend. The vulnerability exists in versions 9.1.6 and below. When an authenticated user loads Espo with a URI containing double slashes (for example, https://domain//#Admin), and the webserver does not strip the duplicate separator, the Slim router cache becomes corrupted. The corrupted cache renders the EspoCRM instance unusable until administrators perform a complete cache rebuild. This condition maps to [CWE-444] (Inconsistent Interpretation of HTTP Requests).

Critical Impact
A low-privileged authenticated user can trigger persistent application-level denial of service by requesting a URI beginning with double slashes, corrupting the Slim router cache.

Affected Products

EspoCRM versions 9.1.6 and below
EspoCRM deployments where the webserver does not normalize duplicate slashes in request URIs
Self-hosted EspoCRM instances relying on the default Slim router cache behavior

Discovery Timeline

2025-08-05 - CVE-2025-52892 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-52892

Vulnerability Analysis

EspoCRM relies on the Slim PHP micro-framework to route incoming HTTP requests to controller handlers. Slim caches compiled route dispatch data to improve performance across requests. When EspoCRM receives a request whose URI begins with a double slash, the routing layer interprets the path differently than expected and writes malformed entries into the router cache. Subsequent legitimate requests then reference the corrupted cache and fail. Because the cache persists on disk, the failure state remains until an administrator rebuilds it, producing a durable denial-of-service condition against the CRM application.

Root Cause

The root cause is inconsistent interpretation of the request URI between the webserver and the EspoCRM application layer. Slim compiles route data assuming a normalized path. When the leading // reaches the router unmodified, the cached dispatch table stores an invalid structure. EspoCRM did not reject malformed URIs before delegating them to Slim's routing cache.

Attack Vector

An attacker with valid low-privilege credentials sends a single request to any EspoCRM URL prefixed with an additional slash, such as https://target.example.com//#Admin or https://target.example.com//api/v1/App/user. The request is network-reachable and requires no user interaction beyond the attacker's own authenticated session. Successful triggering corrupts the shared router cache and disrupts availability for all users of the instance.

php

// Security patch: application/Espo/Core/Api/Starter.php
 use Espo\Core\Utils\Log;

 use Psr\Container\ContainerInterface;
+use Psr\Http\Server\RequestHandlerInterface as Psr7Handler;
 use Slim\App as SlimApp;
+use Slim\Exception\HttpBadRequestException;
 use Slim\Factory\AppFactory as SlimAppFactory;

 use Psr\Http\Message\ResponseInterface as Psr7Response;

// Security patch: application/Espo/Core/Application/Runner.php
 namespace Espo\Core\Application;

+use Espo\Core\Application\Exceptions\RunnerException;
+
 /**
  * Runs an application.
  */
 interface Runner
 {
+    /**
+     * @throws RunnerException
+     */
     public function run(): void;
 }
// Source: https://github.com/espocrm/espocrm/commit/929611f317ce8892ea75873b0ab3094c0c510ff3

The patch introduces HttpBadRequestException handling so that URIs starting with a double slash are rejected before reaching Slim's route cache, and formalizes a RunnerException contract for the application runner.

Detection Methods for CVE-2025-52892

Indicators of Compromise

Web access logs containing request paths beginning with // directed at EspoCRM endpoints.
Sudden application-wide 500-level errors from EspoCRM immediately following a request with a malformed URI.
Router cache files under the EspoCRM data/cache directory containing malformed dispatch entries.

Detection Strategies

Inspect reverse proxy and webserver access logs for HTTP requests where the path component starts with two or more consecutive forward slashes.
Correlate authenticated user sessions with subsequent instance-wide availability failures to identify a triggering account.
Monitor EspoCRM PHP error logs for Slim routing exceptions and cache deserialization errors that appear after a malformed request.

Monitoring Recommendations

Enable HTTP request logging on the fronting webserver (Nginx, Apache, or a load balancer) with the raw request URI captured before any rewriting.
Alert on availability regressions of the EspoCRM /api/v1/ endpoints returning consistent 500 responses across users.
Track modifications to the EspoCRM cache directory outside of scheduled deployments or administrative rebuilds.

How to Mitigate CVE-2025-52892

Immediate Actions Required

Upgrade EspoCRM to version 9.1.7 or later, which rejects requests with double-slash URIs at the application entry point.
If patching is delayed, configure the fronting webserver to normalize or strip duplicate slashes from request URIs before they reach PHP.
Clear the EspoCRM router cache after upgrading to remove any corrupted entries persisted by prior exploitation attempts.

Patch Information

The fix is available in EspoCRM 9.1.7. The upstream commit 929611f317ce8892ea75873b0ab3094c0c510ff3 modifies application/Espo/Core/Api/Starter.php to throw an HttpBadRequestException when the request URI begins with //, and adds a RunnerException contract to application/Espo/Core/Application/Runner.php. Review the GitHub Security Advisory GHSA-26x2-6wch-j8pf and the upstream commit before deploying.

Workarounds

Add a webserver rule that returns HTTP 400 for any request whose path starts with // before proxying to EspoCRM.
Enable path normalization on the reverse proxy so consecutive slashes are collapsed prior to backend forwarding.
Restrict EspoCRM access to trusted networks or authenticated VPN users to reduce the pool of accounts that can trigger the condition.

bash

# Nginx configuration example: reject URIs starting with double slashes
server {
    listen 443 ssl;
    server_name crm.example.com;

    # Merge consecutive slashes in the request URI
    merge_slashes on;

    # Explicitly reject any request whose path still begins with //
    if ($request_uri ~ ^//) {
        return 400;
    }

    location / {
        proxy_pass http://espocrm_backend;
    }
}