{"affected":[{"conditional":false,"product":"espocrm","source":"NVD","vendor":"espocrm","versions":[{"lessThan":"9.3.4","status":"affected","version":"*","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.4","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-33656","cwes":["CWE-22"],"description":"EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server's `open_basedir` scope. Version 9.3.4 fixes the issue.","epss":null,"exploits":[{"kind":"exploit","source":"security-advisories@github.com","url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x"},{"kind":"exploit","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x"}],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794438600263,"publishedAt":1776892625330,"references":[{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x"}],"remediation":[],"revision":"73ea2b2e16bcd49c45f597d945850ade6111c339c22545191cf83e88bfddea33","sources":[{"modifiedAt":1794438600263,"name":"NVD","retrievedAt":1794442728573,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33656"}],"ssvc":{"assessedAt":1776952051281,"automatable":"no","exploitation":"poc","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"total"},"status":"published","title":"CVE-2026-33656","updatedAt":1794442728573}