CVE-2025-52575 EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements

What is CVE-2025-52575?

CVE-2025-52575 is a medium-severity authentication bypass vulnerability in espocrm, published on 21 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory information depending on the LDAP server configuration. This was fixed in version 9.1.7.

Weakness: CWE-90

Which versions are affected by CVE-2025-52575?

It affects 1 product.

Products include Espocrm Espocrm.

How do I fix CVE-2025-52575?

No fix has been published for CVE-2025-52575 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-52575 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-52575 exists.

Other vulnerabilities in espocrm

• CVE-2014-7985 Path traversal in n/a Critical 10.0
• CVE-2026-33656 Path traversal in espocrm Critical 9.1
• CVE-2022-38843 File upload in n/a High 8.8
• CVE-2019-14351 Information disclosure in n/a High 8.8
• CVE-2020-37094 EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rjm8-77fr-4f3v.