CVE-2025-52892 EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache
Attackers can cause a denial of service in EspoCRM by sending requests with double slashes, corrupting the router cache and rendering the instance unusable.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-52892?
CVE-2025-52892 is a medium-severity denial of service vulnerability in espocrm, published on 5 Aug 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7.
Weakness: CWE-444
Which versions are affected by CVE-2025-52892?
It affects 1 product.
Products include Espocrm Espocrm.
How do I fix CVE-2025-52892?
No fix has been published for CVE-2025-52892 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-52892 being exploited?
There is no known exploitation of CVE-2025-52892 in the wild and no public exploit code.
Other vulnerabilities in espocrm
Sources
Also known as GHSA-26x2-6wch-j8pf.