Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2026-55184: EspoCRM lets attackers hijack sessions via templates
CVE-2026-55184 · published 3 days ago
Summary
EspoCRM versions before 9.3.9 allow a user with template‑editing rights to save malicious HTML in email or PDF templates. When another user opens that template while content‑security‑policy protection is turned off, the hidden code runs and can take over the user’s session. Upgrade to version 9.3.9 or later, or ensure CSP is enabled, to prevent this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| espocrm | espocrm | < 9.3.9 |
Original advisory text
EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.
References
- https://github.com/espocrm/espocrm/commit/67223bfb82338c030f38dac03f12c73b7b3d76... Patch
- https://github.com/espocrm/espocrm/releases/tag/9.3.9 URL
- https://github.com/espocrm/espocrm/security/advisories/GHSA-x5p5-8mxj-9wv6 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55184... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55184 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Oct 2026
Updated17 Oct 2026
First seen15 Oct 2026
Track software like this
Free during beta