Input validation error in EspoCRM - CVE-2025-52892
Published: April 23, 2026
Vulnerability identifier: #VU126930
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-52892
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input handling in the Slim router cache when processing a URI containing a double slash. A remote privileged user can load the application in a browser with a double-slash URI to cause a denial of service.
The issue occurs if the web server does not strip the double slash, and user interaction is required to load the crafted URI.
Affected software
EspoCRM
How to mitigate CVE-2025-52892
Install security update from vendor's website.
EspoCRM - update to 9.1.7