CVE-2026-105831 Overview
CVE-2026-105831 is a stored HTML injection vulnerability affecting EspoCRM versions prior to 10.0.6. Unauthenticated attackers can inject arbitrary HTML by submitting crafted data through the public Lead Capture form. The submitted request body is persisted in LeadCaptureLogRecord.data and later rendered without escaping when administrators view the corresponding log record in the EspoCRM interface. Content Security Policy (CSP) controls prevent JavaScript execution, which limits the vulnerability to HTML injection rather than full cross-site scripting. The flaw is tracked under CWE-79 and reaches the administrator context without authentication.
Critical Impact
Unauthenticated attackers can plant persistent HTML content viewed by EspoCRM administrators, enabling phishing lures, UI redress, and content spoofing within the administrative console.
Affected Products
- EspoCRM versions prior to 10.0.6
- EspoCRM Lead Capture public form endpoint
- LeadCaptureLogRecord log viewer in the administrative interface
Discovery Timeline
- 2026-10-08 - CVE-2026-105831 published to the National Vulnerability Database
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-105831
Vulnerability Analysis
EspoCRM exposes a public Lead Capture form endpoint that accepts form submissions from unauthenticated visitors. The application stores the full request body inside the data field of a LeadCaptureLogRecord entity for audit purposes. When an administrator subsequently inspects the log record through the web interface, EspoCRM renders the stored content without applying HTML escaping. Attackers can therefore embed arbitrary HTML markup, including <iframe>, <img>, <a>, and styled containers, which executes in the administrator browser context. Content Security Policy enforcement blocks inline and remote script execution, so the impact remains constrained to markup rendering rather than full script execution. This matches the integrity-only impact profile reflected in the vulnerability record.
Root Cause
The root cause is missing output encoding on data persisted from an untrusted, unauthenticated input channel. EspoCRM treats the Lead Capture log viewer as an administrative interface and renders stored request data as HTML rather than text. The application fails to apply contextual output escaping before rendering the LeadCaptureLogRecord.data field, violating the CWE-79 principle of neutralizing user-controlled input during web page generation.
Attack Vector
Exploitation requires only network access to a publicly reachable Lead Capture form. The attacker submits a crafted POST request containing HTML payloads in form parameters. No authentication, tokens, or user interaction with the attacker are required at submission time. The payload is triggered when an administrator opens the lead capture log record. User interaction on the victim side (administrator viewing the log) is required, which aligns with the UI:P component of the vulnerability vector. See the GitHub Security Advisory and the VulnCheck Advisory on EspoCRM for additional technical context.
No verified public proof-of-concept code is published for CVE-2026-105831. Refer to the vendor advisory for payload details and reproduction steps.
Detection Methods for CVE-2026-105831
Indicators of Compromise
- Lead Capture submissions containing HTML tags such as <iframe, <img, <svg, or <a href= inside name, email, or free-text fields.
- LeadCaptureLogRecord rows whose data field contains encoded or raw HTML markup rather than plain text values.
- Outbound administrator browser requests to unexpected external domains referenced from rendered log records.
Detection Strategies
- Inspect stored LeadCaptureLogRecord entries for HTML control characters and tag patterns using database queries or log review.
- Deploy a Web Application Firewall rule that flags Lead Capture form submissions containing angle brackets or HTML entity sequences.
- Monitor administrator sessions for anomalous DOM content, redirects, or credential prompts generated from the lead capture log view.
Monitoring Recommendations
- Forward EspoCRM application logs and web server access logs to a centralized analytics platform for correlation of suspicious Lead Capture submissions.
- Alert on repeated Lead Capture POST requests from the same source IP containing tag-like syntax.
- Review administrator activity audit logs for access to log records that contain previously flagged submissions.
How to Mitigate CVE-2026-105831
Immediate Actions Required
- Upgrade EspoCRM to version 10.0.6 or later across all production and staging deployments.
- Audit existing LeadCaptureLogRecord entries and purge any records containing HTML markup before administrators open them.
- Restrict administrative access to the EspoCRM backend through network allow-listing or VPN during the remediation window.
Patch Information
The vendor addressed CVE-2026-105831 in EspoCRM 10.0.6. The fix is documented in the GitHub Security Advisory GHSA-xfqv-j65r-qqgh. Administrators should follow the standard EspoCRM upgrade procedure and verify the installed version after deployment.
Workarounds
- Disable public Lead Capture forms until the upgrade to 10.0.6 is complete.
- Place a Web Application Firewall in front of EspoCRM to strip or reject HTML markup submitted to Lead Capture endpoints.
- Maintain the existing Content Security Policy configuration to continue blocking script execution from injected markup.
Refer to the EspoCRM security advisory for vendor-recommended configuration guidance.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
