Vulnerability · Published May 19, 2026 · Assigned by GitHub_M
CVE-2026-33741EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript
Medium 6.8
In plain English
A medium-severity cross-site scripting in espocrm from espocrm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents through both the attachment and image entry points, resulting in stored cross-user XSS reachable through a normal attachment workflow. Although inline SVG script is blocked by the response CSP, the same CSP still allows same-origin external script. As a result, an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment, then trick another user into opening the SVG to execute JavaScript in the victim's EspoCRM origin. This issue has been fixed in version 9.3.4.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
References
- https://github.com/espocrm/espocrm/security/advisories/GHSA-5wh5-ccv2-m3pv x_refsource_CONFIRM