{"affected":[{"conditional":false,"product":"espocrm","source":"NVD","vendor":"espocrm","versions":[{"lessThan":"9.3.4","status":"affected","version":"*","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.4","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-33733","cwes":["CWE-23"],"description":"EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use `../` sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to `body.tpl` or `subject.tpl` under the web application user's filesystem permissions. Version 9.3.4 fixes the issue.","epss":null,"exploits":[{"kind":"exploit","source":"security-advisories@github.com","url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh"},{"kind":"exploit","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh"}],"kev":null,"metrics":[{"score":7.2,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794438600263,"publishedAt":1776892625970,"references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh"}],"remediation":[],"revision":"fc058095416d4c5eb811998dac02aef4d944c93aa3018ae171f216bcdbffdd97","sources":[{"modifiedAt":1794438600263,"name":"NVD","retrievedAt":1794442728969,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33733"}],"ssvc":{"assessedAt":1776951373697,"automatable":"no","exploitation":"poc","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"total"},"status":"published","title":"CVE-2026-33733","updatedAt":1794442728969}