CVE-2026-63130

5.5 Moyenne

Publiée le 15/10/2026 à 17:17 · Modifiée le 15/10/2026 à 18:18 · Analyse NVD reportée · Source : security-advisories@github.com

Description

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10.

Traduire en français

Produits concernés

espocrm

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L`

Faiblesses (CWE)

CWE-22

Références

https://github.com/espocrm/espocrm/commit/31540a04ca8ea96519c7dbf2d8d2273218e69ce6
https://github.com/espocrm/espocrm/releases/tag/9.3.10
https://github.com/espocrm/espocrm/security/advisories/GHSA-jr5q-25fw-27f8

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories