CVE-2026-33733 EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete
An authenticated admin can exploit path traversal in EspoCRM to read, write, or delete arbitrary files on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33733?
CVE-2026-33733 is a high-severity path traversal vulnerability in espocrm, published on 22 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use `../` sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to `body.tpl` or `subject.tpl` under the web application user's filesystem permissions. Version 9.3.4 fixes the issue.
Weakness: CWE-23
Which versions are affected by CVE-2026-33733?
It affects 1 product.
Products include Espocrm Espocrm.
How do I fix CVE-2026-33733?
No fix has been published for CVE-2026-33733 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-33733 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33733 exists.
Other vulnerabilities in espocrm
Sources
Also known as GHSA-44c3-xjfp-3jrh.