CVE-2026-113643 in EspoCRM
Summary
by MITRE • 10/20/2026
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in EspoCRM versions up to 9.3.10 and 10.0.10 represents a critical security flaw within the application's PDF rendering pipeline, specifically located in the ImageSourceProvider::get function found in the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php. This component is responsible for handling image sources during the generation of PDF documents from CRM data. The core technical issue stems from an improper validation mechanism when processing the ID argument passed to this function. Instead of strictly verifying that the requested resource belongs to a user with appropriate permissions or exists within authorized boundaries, the application fails to enforce adequate access controls on the input identifier. This oversight allows an attacker who can manipulate the ID parameter to bypass standard authorization checks, effectively granting them access to resources they should not be able to view or interact with through this specific vector.
From a technical perspective, this flaw is classified under CWE-287, which denotes Improper Authentication, and more specifically aligns with CWE-862, Missing Authorization, as the system fails to verify that the user has permission for the requested action on the specified resource. The vulnerability enables an attacker to perform unauthorized access by supplying crafted input values that trick the ImageSourceProvider into retrieving sensitive images or data associated with other users or administrative functions. Since the PDF rendering pipeline is often triggered during routine business operations such as generating invoices, reports, or client summaries, this flaw can be exploited in a context where legitimate user actions are performed, making it particularly dangerous for stealthy exploitation.
The operational impact of this vulnerability is significant due to its remote exploitability and potential for data leakage. An attacker with network access to the EspoCRM instance can initiate attacks remotely without requiring prior authentication if other parts of the application allow unauthenticated triggers, or more commonly, by leveraging valid but low-privileged user accounts that have permission to trigger PDF generation. By manipulating the ID parameter, an adversary could potentially exfiltrate sensitive customer information, financial data, or internal documents embedded as images within generated PDFs. This constitutes a direct breach of confidentiality and integrity principles defined in standard security frameworks. In terms of attack patterns, this behavior maps to MITRE ATT&CK techniques related to Collection via File Discovery or Data from Information Repositories, depending on the specific nature of the accessed resources, highlighting how application logic flaws can facilitate broader data collection campaigns against enterprise environments.
To mitigate this risk, it is imperative for administrators and developers to apply the provided patch immediately. The fix, identified by commit hash 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2, addresses the root cause by implementing stricter validation logic within the ImageSourceProvider::get function. This likely involves ensuring that every ID passed to the method is cross-referenced against the current user's permission scope and ownership records before any file system or database retrieval occurs. Organizations running affected versions must upgrade their EspoCRM installation to version 9.3.10, 10.0.10, or later where this logic has been corrected. Additionally, as a defense-in-depth measure, it is recommended to review web application firewall rules to detect anomalous patterns in PDF generation requests and to conduct regular code audits focusing on input validation within file handling components to prevent similar authorization bypasses in other parts of the application ecosystem.