CVE-2026-55184: EspoCRM Stored XSS Vulnerability

CVE-2026-55184 Overview

CVE-2026-55184 is a stored cross-site scripting (XSS) vulnerability in EspoCRM, an open source customer relationship management application. The flaw affects all versions prior to 9.3.9. A user with Email Template or PDF Template edit permission can store crafted HTML that bypasses the moderateSanitizeHtml() sanitizer. When another user opens the template in edit mode and clientCspDisabled is set to true, the stored payload executes in the victim's browser context. The vulnerability is tracked under [CWE-79] and was fixed in EspoCRM version 9.3.9.

Critical Impact
An authenticated low-privilege user can hijack another user's session by storing malicious HTML in Email or PDF templates when Content Security Policy is disabled.

Affected Products

EspoCRM versions prior to 9.3.9
EspoCRM instances with clientCspDisabled set to true
Deployments allowing users with Email Template or PDF Template edit permission

Discovery Timeline

2026-10-15 - CVE-2026-55184 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-55184

Vulnerability Analysis

The vulnerability resides in EspoCRM's client-side HTML sanitization routine, moderateSanitizeHtml(). The function is intended to strip event handlers and other active HTML content from templates before rendering. An attacker with Email Template or PDF Template edit permission can craft HTML that defeats the sanitizer's parsing logic. The malicious payload is stored in the template record and persists across sessions.

When a second user opens the affected template in edit mode, the client renders the stored content. If the deployment has clientCspDisabled set to true, the browser lacks a Content Security Policy restriction to block inline script execution. The payload then runs under the victim's authenticated session, enabling session hijacking, data exfiltration from the CRM interface, or forged requests on behalf of the victim.

Root Cause

The root cause is incomplete HTML sanitization inside stripEventHandlersInHtml() in client/src/view-helper.js. The patch in commit 67223bfb82338c030f38dac03f12c73b7b3d760f corrects iterator variable handling during HTML slicing, closing a gap that allowed crafted markup to retain event handler attributes after sanitization. The weakness is classified as improper neutralization of input during web page generation [CWE-79].

Attack Vector

Exploitation requires an authenticated user with edit rights on Email or PDF Templates and a victim who opens the tampered template in edit mode. User interaction is required on the victim side. The attack is only effective when clientCspDisabled is true, since an active CSP would block the injected script.

javascript

// Patch excerpt from client/src/view-helper.js
// Commit: 67223bfb82338c030f38dac03f12c73b7b3d760f
     * @returns {string}
     */
    stripEventHandlersInHtml(html) {
-        let j; // @todo Revise.
+        let j;

        function stripHTML() {
            html = html.slice(0, strip) + html.slice(j);
+
            j = strip;

            strip = false;

Source: GitHub Commit 67223bf

Detection Methods for CVE-2026-55184

Indicators of Compromise

Email or PDF Template records containing HTML with event handler attributes such as onerror, onload, or onclick
Template bodies that include obfuscated <script> fragments or encoded JavaScript URIs
Unexpected modifications to Email Template or PDF Template records by non-administrative accounts
Outbound requests to attacker-controlled domains originating from authenticated CRM browser sessions

Detection Strategies

Audit the EspoCRM database for Email and PDF Template entities containing suspicious HTML tags or inline handlers
Review application logs for template edit events made by users with limited administrative scope
Inspect browser telemetry for script execution within EspoCRM template editor views
Correlate session token reuse from unusual IP addresses with recent template edits

Monitoring Recommendations

Enable detailed audit logging for template create and update actions in EspoCRM
Monitor web server logs for anomalous POST requests to template API endpoints
Alert on configuration changes that disable client-side CSP enforcement
Track user sessions that access template records shortly before unusual API activity

How to Mitigate CVE-2026-55184

Immediate Actions Required

Upgrade EspoCRM to version 9.3.9 or later, which contains the sanitizer fix
Review all Email Template and PDF Template records for previously injected HTML payloads
Restrict template edit permissions to trusted administrative roles only
Re-enable client-side Content Security Policy by setting clientCspDisabled to false

Patch Information

The fix is included in EspoCRM 9.3.9, released on GitHub. The vendor advisory is tracked as GHSA-x5p5-8mxj-9wv6. The code change is available in commit 67223bf and bundled in the 9.3.9 release.

Workarounds

Keep clientCspDisabled set to false so the browser enforces script restrictions on template content
Remove Email Template and PDF Template edit permissions from standard user roles until patching completes
Manually sanitize existing template records to remove inline event handlers and script tags

bash

# Upgrade EspoCRM to the patched release
wget https://github.com/espocrm/espocrm/releases/download/9.3.9/EspoCRM-9.3.9.zip
unzip EspoCRM-9.3.9.zip -d /var/www/espocrm-9.3.9
# Follow the official upgrade procedure, then verify version
php /var/www/espocrm/bin/command app-info | grep -i version