CVE-2026-88896— EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
Quick assessment
Affected
espocrm espocrm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EspoCRM 10.0.4 之前的版本存在服务端请求伪造（SSRF）漏洞。 函数用于验证出站 URL，以阻止请求发往内部/私有 IP 地址。该函数会剥离 （IPv4 映射的 IPv6）前缀，但未能识别那些内嵌私有 IPv4 地址的 IPv6 过渡地址，包括：NAT64（ ）、6to4（ ）和 Teredo（ ）。 攻击者若控制某个域名，其 AAAA 记录指向上述过渡地址，即可绕过内部主机校验以及 的 IP 固定检查，从而诱导 EspoCRM 向内部网络服务发起出站请求。 受影响的代码路径包括： ：任何拥有附件访问
Possible ATT&CK Techniques 1 AI
T1090 · Proxy
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88896
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services. Affected paths include POST /Attachment/fromImageUrl, reachable by any authenticated user with attachment access, and outbound webhook delivery, which requires an admin or API user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-88896
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88896
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-88896 (2)
IV. Related Vulnerabilities
Same product: espocrm
-
CVE-2026-41141
EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity -
CVE-2026-41160
EspoCRM: Broken Access Control / IDOR in Note Pinning API al -
CVE-2026-33741
EspoCRM: Stored XSS via SVG attachment loading same-origin J -
CVE-2026-33733
EspoCRM has Admin TemplateManager path traversal that allows -
CVE-2026-33656
EspoCRM vulnerable to authenticated RCE via Formula with pat
Same vendor: espocrm
-
CVE-2026-41141
EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity -
CVE-2026-41160
EspoCRM: Broken Access Control / IDOR in Note Pinning API al -
CVE-2026-33741
EspoCRM: Stored XSS via SVG attachment loading same-origin J -
CVE-2026-33733
EspoCRM has Admin TemplateManager path traversal that allows -
CVE-2026-33656
EspoCRM vulnerable to authenticated RCE via Formula with pat
Same weakness: CWE-918
-
CVE-2026-88892
OpenPanel SSRF via Unguarded Importer File URL Fetch -
CVE-2026-88001
Open WebUI: Server-side fetches reach blocked and internal h -
CVE-2026-87999
Open WebUI: Any authenticated user can reach the Azure platf -
CVE-2026-19233
CWE-918：服务器请求伪造（SSRF）漏洞 -
CVE-2026-86771
Snipe-IT before 8.7.0 Server-Side Request Forgery via employ
V. Comments for CVE-2026-88896
No comments yet