CVE-2026-55184

CVSS 3.5 (low) · published 2026-10-15

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.

Weakness: CWE-79

Source: NVD CVE-2026-55184

References

• https://github.com/espocrm/espocrm/commit/67223bfb82338c030f38dac03f12c73b7b3d760f
• https://github.com/espocrm/espocrm/releases/tag/9.3.9
• https://github.com/espocrm/espocrm/security/advisories/GHSA-x5p5-8mxj-9wv6

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.