CVE-2025-59428: EspoCRM CSRF Vulnerability

CVE-2025-59428 Overview

CVE-2025-59428 affects EspoCRM, an open source customer relationship management (CRM) application. Versions before 9.1.9 allow arbitrary user creation, including administrative accounts, by chaining stored Scalable Vector Graphics (SVG) injection with missing Cross-Site Request Forgery (CSRF) protection on the user API endpoint. An attacker with Knowledge Base edit permissions embeds a malicious SVG link in an article. A victim who clicks the link and re-enters credentials on an attacker-controlled page triggers a forged request against api/v1/User, provisioning an account with attacker-chosen privileges. The issue is patched in EspoCRM 9.1.9.

Critical Impact
Successful exploitation lets an attacker with low-privileged Knowledge Base edit rights create arbitrary users, including administrators, resulting in full compromise of the CRM tenant.

Affected Products

EspoCRM versions prior to 9.1.9
Deployments exposing the Knowledge Base feature to non-administrative users
Instances where the api/v1/User endpoint lacks CSRF token enforcement

Discovery Timeline

2025-10-14 - CVE-2025-59428 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59428

Vulnerability Analysis

The flaw combines two weaknesses tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-352 (Cross-Site Request Forgery). EspoCRM's Knowledge Base article body accepts SVG markup without sufficient neutralization, enabling stored injection of clickable elements. Separately, the api/v1/User endpoint accepts state-changing requests without validating an anti-CSRF token.

An attacker with Knowledge Base edit permissions stores a malicious SVG containing a link pointing to an attacker-controlled page. When a logged-in user clicks the link, the external page issues a forged request to the EspoCRM API using the victim's authenticated session. If the session has already expired, the browser displays the standard credential prompt. Once the victim re-authenticates, the forged user-creation request executes with the victim's privileges, producing an attacker-controlled account.

Root Cause

The root cause is dual. First, the Knowledge Base rich-text sanitizer permits SVG elements and anchor targets that carry executable navigation. Second, the user management API does not enforce origin, referer, or token-based CSRF protection, allowing cross-site requests to create accounts.

Attack Vector

Exploitation requires an authenticated attacker with Knowledge Base edit rights and user interaction from a victim possessing user-creation privileges. The attack chain is network-reachable, requires one click, and crosses the trust boundary between the Knowledge Base content and the EspoCRM administrative API.

The exploitation sequence proceeds as follows:

The attacker authors a Knowledge Base article containing an SVG element with a hyperlink to an attacker-controlled host.
A privileged user navigates to the article and clicks the embedded link.
The attacker's HTML page submits a forged POST request to api/v1/User using the victim's session cookies.
The forged payload defines the username, password, and role of the new account, including administrative role assignment.

No verified public proof-of-concept code is available at the time of writing. Refer to the EspoCRM GitHub Security Advisory GHSA-c26c-wvhr-fr6r for vendor technical details.

Detection Methods for CVE-2025-59428

Indicators of Compromise

Unexpected POST requests to api/v1/User originating from browsers immediately after Knowledge Base article views.
New user accounts created outside of change-managed provisioning workflows, especially with administrative roles.
Knowledge Base articles containing <svg> elements with embedded <a> tags pointing to external domains.
Authentication prompts appearing to users immediately after clicking links inside Knowledge Base content.

Detection Strategies

Inspect EspoCRM web server access logs for api/v1/User requests whose Referer header is an external domain.
Scan Knowledge Base article records for stored SVG markup or anchor elements referencing non-corporate hosts.
Correlate user-creation events in the EspoCRM audit log with the acting user's recent Knowledge Base navigation history.

Monitoring Recommendations

Alert on administrative role assignments performed by non-administrator sessions.
Baseline the daily rate of user-creation API calls and alert on deviations.
Review Knowledge Base contributor accounts periodically and restrict edit permissions to trusted users.

How to Mitigate CVE-2025-59428

Immediate Actions Required

Upgrade EspoCRM to version 9.1.9 or later, which contains the vendor patch.
Audit all accounts created since the Knowledge Base feature was enabled and disable any unauthorized administrative accounts.
Review Knowledge Base articles for embedded SVG elements and remove suspicious content.
Rotate credentials for any user who may have authenticated on an attacker-controlled page.

Patch Information

The vendor fixed the vulnerability in EspoCRM 9.1.9. The fix is published in the EspoCRM GitHub Security Advisory GHSA-c26c-wvhr-fr6r. Apply the upgrade through the standard EspoCRM update procedure and validate the version string after deployment.

Workarounds

Restrict Knowledge Base edit permissions to administrators until the patched version is deployed.
Place EspoCRM behind a web application firewall rule that blocks api/v1/User requests lacking a same-origin Referer header.
Disable or sanitize SVG rendering in Knowledge Base articles via server-side content filtering.
Enforce short session lifetimes and require re-authentication through a dedicated login flow rather than inline credential prompts.

bash

# Verify installed EspoCRM version after upgrade
grep -R "'version'" /path/to/espocrm/application/Espo/Resources/defaults/config.php

# Example web server rule to block cross-origin user creation requests
# (nginx fragment)
location = /api/v1/User {
    if ($http_referer !~* "^https?://crm\.example\.com") {
        return 403;
    }
    proxy_pass http://espocrm_backend;
}