PatchTheCVECVE-2026-33534: EspoCRM is an open source customer relationship management application
CVE-2026-33534 is a medium-severity flaw (CVSS 4.3) affecting espocrm. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which d
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 2.0% (top 20%) |
| CISA exploited list | No |
| Weakness | CWE-918 |
| Published | 2026-04-13 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: EspoCRM 9.3.3 - SSRF
- Nuclei scan template: EspoCRM <= 9.3.3 - Server-Side Request Forgery
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-33534?
espocrm: upgrade to 9.3.4. Exact commands for each OS are on this page.
Is CVE-2026-33534 being exploited?
CVE-2026-33534 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-33534 affect?
CVE-2026-33534 affects espocrm. Severity is medium (CVSS 4.3). EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using altern
How urgent is CVE-2026-33534?
Priority 40/100. Public exploit reference
Software pages
Related CVEs
- CVE-2026-33740 MEDIUM 5.4 UPGRADE EspoCRM is an open source customer relationship management application
- CVE-2026-33733 HIGH 7.2 UPGRADE EspoCRM is an open source customer relationship management application
- CVE-2026-33659 LOW 3.5 UPGRADE EspoCRM is an open source customer relationship management application
- CVE-2026-33657 MEDIUM 4.6 UPGRADE EspoCRM is an open source customer relationship management application
- CVE-2026-33656 CRITICAL 9.1 UPGRADE EspoCRM is an open source customer relationship management application