CVEvulnerability

CVE-2026-47168

9.1 CRITICAL Published 2026-10-15 Modified 2026-10-20 Official page ↗
Status
Deferred
Published
2026-10-15
Last modified
2026-10-20
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-502

Description

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References