CVE-2026-47168
9.1CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Authenticated administrators can achieve remote code execution on the underlying server. Exploitation requires administrator privileges to submit crafted serialized PHP objects via background MassAction or Export parameters.
Root cause
The application deserializes user-supplied PHP object data from MassAction and Export parameters without restricting allowed classes, leading to insecure object instantiation.
Affected systems
EspoCRM versions prior to 9.3.7
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade EspoCRM to version 9.3.7. If an immediate upgrade is not possible, restrict and audit administrator accounts with access to MassAction and Export functions.
$ php command.php upgradeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.