CVE-2026-59994— EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received
Quick assessment
Affected
espocrm espocrm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EspoCRM 是一款开源客户关系管理（CRM）应用程序。在 9.3.9 版本之前，未经身份验证的远程攻击者可以向受监控的群组或 IMAP 地址（包括通过电子邮件创建工单（Email-to-Case）的地址）发送一封电子邮件，并在其纯文本正文中插入任意 HTML 代码。EspoCRM 会存储该正文内容，并在向相关记录关联的用户发送“邮件接收”流通知邮件时，未经转义直接渲染该内容，从而导致 HTML 注入；在支持执行嵌入脚本的邮件客户端中，还可能引发 JavaScript 代码执行。此前针对“发布”（Post）和“提
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1566.002 · Spearphishing Link
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59994
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received
Source: CVE Program / CVE List V5
Vulnerability Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and renders it without escaping in Email Received stream notification emails sent to users following the related record, allowing HTML injection and, in mail clients that execute it, JavaScript execution. Earlier sanitization for Post and Mention notifications did not cover this notification path. This issue is fixed in version 9.3.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-59994
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59994
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59994 (1)
Vendor Advisories for CVE-2026-59994 (1)
Vendor Pages for CVE-2026-59994 (1)
-
🔗 Release 9.3.9 · espocrm/espocrm · GitHub x_refsource_MISC
Same Patch Batch · espocrm · 2026-10-15 · 12 CVEs total
| CVE-2026-47168 | 9.1 CRITICAL | EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export para |
| CVE-2026-53574 | 7.6 HIGH | EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression |
| CVE-2026-46691 | 6.5 MEDIUM | EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users |
| CVE-2026-46694 | 6.5 MEDIUM | EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes |
| CVE-2026-77460 | 6.5 MEDIUM | EspoCRM: Mass email template renderer leaks restricted record fields |
| CVE-2026-75505 | 6.0 MEDIUM | EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permis |
| CVE-2026-63130 | 5.5 MEDIUM | EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.jso |
| CVE-2026-55154 | 5.4 MEDIUM | EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters |
| CVE-2026-46708 | 4.3 MEDIUM | EspoCRM: Target list Opt-Out actions allows opting out record without access Target List a |
| CVE-2026-55184 | 3.5 LOW | EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled |
| CVE-2026-53575 | 2.7 LOW | EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user |
IV. Related Vulnerabilities
Same product: espocrm
-
CVE-2026-75505
EspoCRM: Access control bypass in Mass Update letting regula -
CVE-2026-77460
EspoCRM: Mass email template renderer leaks restricted recor -
CVE-2026-63130
EspoCRM: Admin path traversal in LabelManager (Custom Label -
CVE-2026-55154
EspoCRM: CSV/Formula Injection sanitizer bypass via leading -
CVE-2026-55184
EspoCRM: Stored XSS in wysiwyg template fields if CSP is dis
Same vendor: espocrm
-
CVE-2026-75505
EspoCRM: Access control bypass in Mass Update letting regula -
CVE-2026-77460
EspoCRM: Mass email template renderer leaks restricted recor -
CVE-2026-63130
EspoCRM: Admin path traversal in LabelManager (Custom Label -
CVE-2026-55154
EspoCRM: CSV/Formula Injection sanitizer bypass via leading -
CVE-2026-55184
EspoCRM: Stored XSS in wysiwyg template fields if CSP is dis
Same weakness: CWE-79
-
CVE-2026-107649
Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Si -
CVE-2026-96768
GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scri -
CVE-2026-110703
GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored -
CVE-2026-104726
Name Directory <= 1.34.2 - Authenticated (Contributor+) Stor -
CVE-2026-109224
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Script
V. Comments for CVE-2026-59994
No comments yet