CVE-2026-53575: EspoCRM XSS Vulnerability

CVE-2026-53575 Overview

CVE-2026-53575 is a stored Cross-Site Scripting (XSS) vulnerability in EspoCRM, an open source customer relationship management (CRM) application. The flaw exists in versions prior to 9.3.9 and allows an authenticated administrator to inject crafted content into the applicationName setting through Content Security Policy (CSP) nonce injection. The injected payload is persisted and rendered into the main application page without proper escaping. When other users load the page, attacker-controlled JavaScript executes in their browser sessions. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attacker-supplied JavaScript executes in authenticated user sessions, enabling theft of page data and unsaved user input across the EspoCRM application.

Affected Products

EspoCRM versions prior to 9.3.9
EspoCRM main application page rendered by ClientManager
Administrator-accessible applicationName configuration setting

Discovery Timeline

2026-10-15 - CVE-2026-53575 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database
Version 9.3.9 - EspoCRM maintainers release the patched version addressing the issue

Technical Details for CVE-2026-53575

Vulnerability Analysis

The vulnerability is a persistent (stored) XSS flaw triggered through the applicationName setting in EspoCRM. An authenticated administrator can place crafted content into this setting using CSP nonce injection. The value is subsequently embedded into the main HTML page without HTML-context escaping. Because the injection point is a global application configuration, every user who loads the main page executes the payload under their own session. Exploitation requires administrator-level privileges, which limits the attacker population to users with high trust. However, the impact extends to lower-privileged users whose sessions and unsaved form data become accessible to the attacker-controlled script.

Root Cause

The root cause lies in the main HTML page rendering logic within application/Espo/Core/Utils/ClientManager.php. The renderer interpolates configuration values, including applicationName, into the HTML template without applying contextual output encoding. The CSP nonce mechanism intended to constrain inline scripts is subverted because the attacker-controlled value is placed in a position where the nonce accompanies the injected markup. This permits the payload to execute despite CSP being in place.

Attack Vector

Exploitation proceeds in two stages. First, an authenticated administrator submits a malicious value for the applicationName setting through the EspoCRM administration interface. Second, any user — including non-administrators — who subsequently loads the main application page triggers execution of the stored payload. The script runs within the application origin and can read Document Object Model (DOM) content, exfiltrate unsaved form input, and perform authenticated actions on behalf of the victim.

php

/**
 * Renders the main HTML page.
+ *
+ * @todo Use Handlebars.
 */
class ClientManager
{

Source: GitHub Commit ce73338

The patch comment indicates the maintainers plan to migrate rendering to Handlebars, a templating engine that performs contextual HTML escaping by default. The immediate fix in 9.3.9 addresses the escaping gap in the main page renderer.

Detection Methods for CVE-2026-53575

Indicators of Compromise

Unexpected HTML, <script> tags, or event-handler attributes present in the applicationName value stored in EspoCRM configuration.
Outbound HTTP requests from user browsers to attacker-controlled domains referrer-linked to the EspoCRM main page.
Administrator audit log entries showing modifications to the applicationName setting outside of normal change windows.

Detection Strategies

Review the current applicationName configuration value and compare against expected branding text; flag any value containing angle brackets, quotes, or nonce strings.
Correlate administrator account activity with changes to global application settings in EspoCRM audit records.
Deploy web application firewall (WAF) rules that inspect settings-save requests to the EspoCRM admin API for HTML or script payloads in the applicationName field.

Monitoring Recommendations

Monitor browser Content Security Policy violation reports for the EspoCRM origin to catch anomalous script sources.
Alert on new or unusual administrator logins preceding configuration changes to global branding settings.
Track outbound DNS and HTTP traffic from user workstations that originates from browser sessions interacting with the EspoCRM main page.

How to Mitigate CVE-2026-53575

Immediate Actions Required

Upgrade EspoCRM to version 9.3.9 or later, which contains the fix in GitHub Release 9.3.9.
Inspect the current applicationName value in your EspoCRM instance and reset it to a plain-text brand name if any markup is present.
Review administrator account access and rotate credentials for any administrator accounts suspected of misuse.

Patch Information

The fix is included in EspoCRM version 9.3.9. The relevant change is applied in application/Espo/Core/Utils/ClientManager.php through commit ce73338. Full remediation details are available in the GitHub Security Advisory GHSA-f34h-xxmv-j9xp.

Workarounds

Restrict administrator role assignments to the minimum necessary personnel until the upgrade is applied.
Enforce multi-factor authentication (MFA) on all EspoCRM administrator accounts to reduce the risk of unauthorized configuration changes.
Validate the applicationName value on each administrative review and remove any content containing HTML characters.

bash

# Upgrade EspoCRM to the patched release
cd /path/to/espocrm
php command.php upgrade --version=9.3.9

# Verify the installed version after upgrade
php command.php app-info | grep -i version