CVE-2026-47168: EspoCRM PHP Deserialization RCE Vulnerability

CVE-2026-47168 Overview

CVE-2026-47168 is a PHP object deserialization vulnerability in EspoCRM, an open source customer relationship management (CRM) application. Versions prior to 9.3.7 allow an authenticated administrator to supply crafted serialized PHP object data through background MassAction or Export parameters. The application later deserializes this data without restricting allowed classes. Attackers can instantiate arbitrary objects and achieve remote code execution on the server. The flaw is tracked as CWE-502 Deserialization of Untrusted Data. EspoCRM 9.3.7 addresses the issue by enforcing an allowed_classes allowlist on affected unserialize() calls.

Critical Impact
Authenticated administrators can trigger PHP object instantiation that leads to arbitrary code execution on the EspoCRM server, impacting confidentiality, integrity, and availability with scope change.

Affected Products

EspoCRM versions prior to 9.3.7
EspoCRM MassAction background processing component
EspoCRM Export entity processing component

Discovery Timeline

2026-10-15 - CVE-2026-47168 published to the National Vulnerability Database (NVD)
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-47168

Vulnerability Analysis

The vulnerability stems from unsafe PHP unserialize() calls in two code paths that handle persisted job parameters. In application/Espo/Core/MassAction/Params.php, the searchParams field was deserialized directly from stored data. In application/Espo/Entities/Export.php, the params field was base64-decoded and deserialized without constraints. Because PHP unserialize() instantiates any class available in the application's class loader, attackers controlling the serialized payload can chain class magic methods such as __wakeup, __destruct, and __toString to form a POP (property-oriented programming) gadget chain. These gadgets can lead to arbitrary code execution within the EspoCRM runtime context.

Root Cause

The root cause is the absence of an allowed_classes option on unserialize() calls processing attacker-influenced data stored in background job parameters. Without this restriction, PHP accepts any serialized class definition, enabling object injection.

Attack Vector

Exploitation requires an authenticated administrator account. The attacker submits a crafted MassAction or Export job with a malicious serialized payload in the searchParams or params fields. When the background worker processes the job, the application deserializes the payload and triggers the gadget chain. The attack is network-reachable and does not require user interaction.

php

// Patched code from application/Espo/Core/MassAction/Params.php
{
    $this->entityType = $data['entityType'];
    $this->ids = $data['ids'];
    $this->searchParams = unserialize($data['searchParams'], [
        'allowed_classes' => [SearchParams::class],
    ]);
}

/**
 * @internal
 */
public static function fromSerializedRaw(string $raw): self
{
    /** @var Params $params */
    $params = unserialize(base64_decode($raw), [
        'allowed_classes' => [Params::class],
    ]);

    return $params;
}

Source: EspoCRM commit f48d1d2. The patch adds an allowed_classes allowlist so unserialize() only accepts SearchParams or Params instances and rejects attacker-chosen classes.

Detection Methods for CVE-2026-47168

Indicators of Compromise

Unexpected PHP processes spawned by the EspoCRM web server user or the cron/background worker process
MassAction or Export job records containing abnormally long, base64-encoded, or binary searchParams or params values
Outbound network connections initiated by PHP-FPM or the EspoCRM worker to unfamiliar hosts
New or modified files under the EspoCRM document root following execution of background jobs

Detection Strategies

Inspect EspoCRM job queue entries for serialized PHP payloads containing object markers such as O: followed by class names outside the expected SearchParams or Params classes
Correlate administrator session activity with the creation of MassAction and Export jobs that immediately precede anomalous process execution
Enable PHP error and application logging to capture unserialize warnings referencing unknown classes

Monitoring Recommendations

Monitor child processes of the web server and background worker for shell interpreters, scripting runtimes, or network utilities
Alert on changes to EspoCRM source files, writable upload directories, and scheduled task configurations
Track administrator account logins, especially from new IP addresses or outside business hours, to limit the window for abuse

How to Mitigate CVE-2026-47168

Immediate Actions Required

Upgrade EspoCRM to version 9.3.7 or later, which enforces allowed_classes on the affected unserialize() calls
Rotate administrator credentials and audit administrator accounts for unauthorized additions or privilege changes
Review the MassAction and Export job history for suspicious entries created before patching and purge any untrusted queued jobs

Patch Information

The fix is included in EspoCRM Release 9.3.7. The underlying code change is documented in GitHub commit f48d1d2 and the GitHub Security Advisory GHSA-7q78-jjr9-mqcg. Both MassAction\Params and Entities\Export now pass an allowed_classes allowlist to unserialize().

Workarounds

Restrict administrator access to the EspoCRM web interface through network-level controls such as IP allowlists or VPN-only access
Enforce multi-factor authentication for all EspoCRM administrator accounts to reduce the risk of credential-based abuse
If immediate patching is not possible, disable MassAction and Export background processing until the upgrade can be applied

bash

# Upgrade EspoCRM to the patched release
cd /path/to/espocrm
php command.php upgrade --to=9.3.7
php command.php clear-cache
php command.php rebuild