CVE-2026-53574
7.6HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-89
Impact
Authenticated non-admin users can dump the database via blind SQL injection and escalate privileges to full admin by extracting active session tokens. An attacker needs valid low-privilege login credentials to EspoCRM.
Root cause
The GET entity streamAttachments endpoint permits complex expressions in the 'where' query parameter without proper sanitization, allowing SQL injection.
Affected systems
EspoCRM 8.1.0 through versions prior to 9.3.8
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Fix & remediation
Upgrade EspoCRM to version 9.3.8 or later. If patching immediately is not possible, restrict or block network access to the entity streamAttachments endpoint at your reverse proxy.
$ php command.php upgradeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.