CRITICAL 9.1 NVD
CVE-2026-47168
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.
References
- https://github.com/espocrm/espocrm/commit/f48d1d26ffa05eac07ef72bb7f00f67a851184e1
- https://github.com/espocrm/espocrm/releases/tag/9.3.7
- https://github.com/espocrm/espocrm/security/advisories/GHSA-7q78-jjr9-mqcg
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-10-15 via NVD.
Risk Timeline
CVE Disclosed2026-10-15 · -1 days ago
Remediation Resources
vulnfeed aggregates 14529 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.