SB2026042345 - Improper Neutralization of Special Elements in Output Used by a Downstream Component in EspoCRM

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2025-32390)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to capture credentials and take over accounts.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in knowledge base articles when rendering user-supplied HTML content. A remote user can create a crafted article that imitates a login page to capture credentials and take over accounts.

Exploitation requires the ability to create articles, and user interaction is required for a victim to open the crafted article and submit credentials.

Remediation

Install update from vendor's website.

References

• https://github.com/espocrm/espocrm/security/advisories/GHSA-qrwp-v8v3-hqp2
• https://github.com/advisories/GHSA-qrwp-v8v3-hqp2