CVE-2026-53574 — EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GE…
Published: 2026-10-15 · CVSS: 7.6 · CVSS 3.1
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7