CVE-2026-33656: EspoCRM Path Traversal Vulnerability

CVE-2026-33656 Overview

CVE-2026-33656 is a Path Traversal vulnerability in EspoCRM, an open source customer relationship management (CRM) application. The vulnerability exists in the built-in formula scripting engine which allows authenticated administrators to update an attachment's sourceId field. Because the sourceId value is concatenated directly into a file path without proper sanitization in EspoUploadDir::getFilePath(), an attacker with administrative privileges can redirect file read or write operations to arbitrary paths within the web server's open_basedir scope.

Critical Impact

Authenticated administrators can exploit the unsanitized sourceId field to perform arbitrary file read/write operations, potentially leading to remote code execution, sensitive data disclosure, or complete system compromise.

Affected Products

• EspoCRM versions prior to 9.3.4

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-33656 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-33656

Vulnerability Analysis

This Path Traversal vulnerability (CWE-22) stems from insufficient input validation in EspoCRM's formula scripting engine. The formula scripting feature allows administrators to update attachment entities, including the sourceId field. When this field is processed by EspoUploadDir::getFilePath(), it is directly concatenated into the file path without any sanitization or validation to prevent directory traversal sequences.

An attacker with administrative access can craft a malicious sourceId value containing path traversal sequences (such as ../) to escape the intended upload directory. This allows the attacker to:

1. Read arbitrary files accessible within the PHP open_basedir configuration
2. Write or overwrite files in locations outside the intended upload directory
3. Potentially achieve remote code execution by writing malicious PHP files to web-accessible directories

The attack surface is limited to authenticated administrators, but the impact is severe as it can lead to complete compromise of the underlying server within the configured PHP restrictions.

Root Cause

The root cause is the absence of input sanitization on the sourceId field before it is used in file path construction within the EspoUploadDir::getFilePath() function. The function directly concatenates user-controlled input into the file path, allowing path traversal sequences to traverse outside the intended directory structure.

Attack Vector

The attack is conducted over the network by an authenticated administrator. The attacker uses EspoCRM's formula scripting functionality to modify the sourceId field on an Attachment entity with a crafted value containing directory traversal sequences. When the application subsequently performs file operations on this attachment, the malicious sourceId causes the operation to target an arbitrary path on the filesystem.

The exploitation mechanism involves leveraging the formula scripting engine's ability to update attachment records, injecting path traversal sequences into the sourceId field, and triggering file operations that use the manipulated path. While administrative privileges are required, this vulnerability can be chained with other vulnerabilities or exploited in scenarios involving compromised admin accounts, insider threats, or multi-tenant deployments where tenant administrators should not have filesystem access.

Detection Methods for CVE-2026-33656

Indicators of Compromise

• Unexpected file modifications or creations outside the EspoCRM upload directory
• Attachment records in the database with sourceId values containing path traversal sequences (../, ..\)
• Web server access logs showing unusual file access patterns or errors related to path resolution
• Audit logs indicating formula script executions that modify attachment sourceId fields

Detection Strategies

• Monitor database queries for updates to the Attachment table's sourceId column with suspicious patterns
• Implement file integrity monitoring (FIM) on web-accessible directories to detect unauthorized file writes
• Review EspoCRM application logs for formula script executions targeting attachment entities
• Deploy web application firewall (WAF) rules to detect path traversal patterns in API requests

Monitoring Recommendations

• Enable detailed logging for administrative actions in EspoCRM
• Configure alerting for file system changes outside expected upload directories
• Monitor for PHP errors related to open_basedir restriction violations which may indicate attempted exploitation
• Implement behavioral analysis for administrative accounts to detect anomalous formula scripting activity

How to Mitigate CVE-2026-33656

Immediate Actions Required

• Upgrade EspoCRM to version 9.3.4 or later immediately
• Review audit logs for any suspicious formula script executions targeting attachment entities
• Verify file integrity of the EspoCRM installation and web server directories
• Restrict administrative access to trusted personnel only

Patch Information

EspoCRM version 9.3.4 addresses this vulnerability by implementing proper input sanitization for the sourceId field. Organizations should upgrade to this version or later as the primary remediation measure. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, disable or restrict access to the formula scripting functionality
• Implement additional PHP open_basedir restrictions to limit the scope of potential file access
• Apply strict file system permissions to prevent the web server user from writing to sensitive directories
• Deploy a web application firewall with rules to detect and block path traversal attempts in API requests

# Example: Restrict PHP open_basedir in Apache configuration
# Add to VirtualHost or .htaccess for EspoCRM
php_admin_value open_basedir "/var/www/espocrm:/tmp"

# Verify current open_basedir setting
php -i | grep open_basedir