SB20260728103 - Multiple vulnerabilities in EspoCRM
Published: July 28, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-59994)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to inject arbitrary HTML into notification emails.
The vulnerability exists due to improper neutralization of input during web page generation in the "Email Received" stream notification email handling when rendering stored email body content into HTML notifications. A remote attacker can send a specially crafted email to a monitored address to inject arbitrary HTML into notification emails.
Depending on the recipient's mail client, injected content may include executable JavaScript. User interaction is required to view the crafted notification email.
2) Cross-site scripting (CVE-ID: CVE-2026-55184)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser.
The vulnerability exists due to cross-site scripting in wysiwyg template fields when processing crafted HTML in Email Template or PDF Template content. A remote user can store malicious HTML in a template to execute arbitrary JavaScript in another user's browser.
User interaction is required when another user opens the template in edit mode. Only instances with Content Security Policy disabled (clientCspDisabled = true) are vulnerable to the full session hijacking scenario.
3) Improper Neutralization of Formula Elements in a CSV File (CVE-ID: CVE-2026-55154)
CWE-ID: CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to execute formula expressions in a spreadsheet application and disclose sensitive information.
The vulnerability exists due to improper neutralization of formula elements in a CSV file in the export processors when handling attacker-controlled field values containing leading whitespace or control characters before a formula trigger character. A remote user can supply a specially crafted field value and have it included in an exported CSV or XLSX file to execute formula expressions in a spreadsheet application and disclose sensitive information.
User interaction is required to open the exported file in a spreadsheet application, and command execution may be possible on legacy Excel configurations with DDE enabled.
4) Cross-site scripting (CVE-ID: CVE-2026-53575)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to cross-site scripting in the applicationName setting when generating the application page. A remote privileged user can inject a JavaScript file to disclose sensitive information.
This may lead to data leakage, including unsaved user input.
Remediation
Install update from vendor's website.