CVE-2026-33534

MEDIUMNuclei

EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-33534 has a selected CVSS score of 4.3 (medium); EIP currently links 1 catalogued exploit, 1 repository PoC, and 1 Nuclei template.

Description

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 14, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

espocrm

Browse espocrm / espocrm
CVE List< 9.3.4affected

Proofs of concept

2

Catalogued exploits

ExploitDBEspoCRM 9.3.3 - SSRFExploitDB exploitby Max GabrielExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to EspoCRM and exploits CVE-2026-33534 by sending SSRF requests to the /api/v1/Attachment/fromImageUrl endpoint using alternative IPv4 loopback representations to bypass internal host validation, then stores the fetched response as an attachment.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that demonstrates the CVE-2026-33534 SSRF vulnerability by sending authenticated HTTP requests to the EspoCRM /api/v1/Attachment/fromImageUrl endpoint with various loopback IP representations. It performs no persistence, credential exfiltration, unrelated remote access, or concealed payload delivery. All behavior is consistent with a legitimate vulnerability verification tool.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareEspoCRM
Attack typesSSRF
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted requests to the vulnerable endpoint to trigger the SSRF vulnerability and create attachments on the server, which constitutes exploitation rather than mere detection or scanning.

exploits/multiple/webapps/52583.py:119-130exploits/multiple/webapps/52583.py:234-244exploits/multiple/webapps/52583.py:264-266

Requirements

  • Valid EspoCRM credentialsexploits/multiple/webapps/52583.py:183-184
  • Target EspoCRM instance URLexploits/multiple/webapps/52583.py:182

Observed behavior

  • Authenticates to EspoCRM using provided credentialsexploits/multiple/webapps/52583.py:208-209
  • Sends a control request to the fromImageUrl endpoint with 127.0.0.1 to verify blockingexploits/multiple/webapps/52583.py:217-225
  • Iterates through a list of alternative IPv4 loopback representations (octal, hex, decimal dword, etc.)exploits/multiple/webapps/52583.py:26-38
  • For each payload, sends a POST request to /api/v1/Attachment/fromImageUrl with the encoded loopback URLexploits/multiple/webapps/52583.py:234-244
  • Checks if the response indicates a successful bypass (HTTP 200 with an attachment id)exploits/multiple/webapps/52583.py:155-162
  • Optionally deletes created attachments for cleanupexploits/multiple/webapps/52583.py:251-255
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Handling
Payload withheldCredentials are used solely for authentication to the user-supplied target URL; no exfiltration to third parties is present.exploits/multiple/webapps/52583.py:183-184exploits/multiple/webapps/52583.py:208-209
Network Activity
Payload withheldAll network requests are directed at the user-provided target URL; no external or unrelated hosts are contacted.exploits/multiple/webapps/52583.py:119-130exploits/multiple/webapps/52583.py:149-152exploits/multiple/webapps/52583.py:234-244
Payload Behavior
Payload withheldThe payloads are designed to bypass internal-host validation; they are not used to download or execute arbitrary code.exploits/multiple/webapps/52583.py:26-38exploits/multiple/webapps/52583.py:234-244
Review boundaries

What the analysis did not establish

  • Only the Python script content was analyzed; no external dependencies or runtime behavior were inspected.
  • The script's actual effectiveness depends on the target's configuration and patch status, which cannot be verified from static analysis alone.
  • Only the single Python file (52583.py) was reviewed; no external dependencies beyond the standard library and the 'requests' module are inspected, but the script does not fetch or execute remote code.
  • Binary content is not present in this artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubEntroVyx/CVE-2026-33534Repository PoCby EntroVyx0Exploit4 files

16.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to EspoCRM, sends SSRF payloads using alternative IPv4 loopback representations to the /api/v1/Attachment/fromImageUrl endpoint, and confirms vulnerability by checking for stored attachments.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script and a README for CVE-2026-33534, an authenticated SSRF vulnerability in EspoCRM. The script sends HTTP requests to a target EspoCRM instance using provided credentials, tests various alternative IPv4 loopback representations to bypass internal host validation, and optionally cleans up created attachments. All behavior is consistent with a legitimate proof-of-concept for the described vulnerability. No concealed executable behavior, credential exfiltration, persistence mechanisms, or unrelated payloads were observed.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwareEspoCRM
Attack typesServer-Side Request Forgery (SSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted requests to exploit the SSRF vulnerability by making the server fetch internal resources and store the response as an attachment. It does not merely detect or report the vulnerability; it exercises it to produce a tangible effect (stored attachment).

CVE-2026-33534.py:3CVE-2026-33534.py:119-130CVE-2026-33534.py:234-244CVE-2026-33534.py:155-162

Requirements

  • Valid EspoCRM credentials with permission to use the target image/attachment fieldREADME.md:22-24
  • Python 3 with requests library installedREADME.md:21-22

Observed behavior

  • Authenticates to EspoCRM using provided username and passwordCVE-2026-33534.py:208-209
  • Sends a control request with direct loopback IP 127.0.0.1 to verify blockingCVE-2026-33534.py:217-225
  • Iterates through alternative IPv4 loopback representations (octal, hex, decimal) and sends each as the image URL to the fromImageUrl API endpointCVE-2026-33534.py:234-244
  • Checks if the server returned HTTP 200 with an attachment ID, indicating successful SSRF and stored attachmentCVE-2026-33534.py:155-162
  • Optionally deletes created attachments after successful exploitationCVE-2026-33534.py:251-255
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldAdvisory URL referenced in the exploit script and README, consistent with the CVE description.CVE-2026-33534.py:10README.md:15
Url
Payload withheldVendor homepage referenced in the exploit script header.CVE-2026-33534.py:6
Url
Payload withheldSoftware link referenced in the exploit script header.CVE-2026-33534.py:7
Url
Payload withheldExploit author's GitHub profile referenced in the script header.CVE-2026-33534.py:5
Review boundaries

What the analysis did not establish

  • Evidence includes only two of four repository files; two files (likely LICENSE and .gitignore) are omitted from text content.
  • The artifact's behavior is inferred from static code analysis; the code was not executed, and its effectiveness against a live target is not verified.
  • Two additional files in the repository (total 4 files, 2 omitted) were not included in the text evidence; their content is unknown.
  • The analysis is limited to static review of the provided source code; no dynamic execution or binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryMEDIUMEspoCRM <= 9.3.3 - Server-Side Request ForgeryCVSS 4.3

EspoCRM <= 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost(), letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint.

Impact

Authenticated attackers can access internal network resources, potentially exposing sensitive data or internal services.

Remediation

Upgrade to version 9.3.4 or later.

WeaknessesCWE-918
AuthorsEntroVyx
Template tagscvecve2026espocrmssrfauthenticatedintrusive
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
https://github.com/espocrm/espocrm/security/advisories/GHSA-h7gx-8gwv-7g73 https://nvd.nist.gov/vuln/detail/CVE-2026-33534

Source: ProjectDiscovery

References

2