File and Path Handling

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to instal…CVE-2014-7985Espocrm · 5.0% likely

   CWE-22

2. EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious…CVE-2022-38843Espocrm · 1.4% likely

   CWE-434

3. Unrestricted Upload of File with Dangerous Type in EspoCRMCVE-2023-5966EspoCRM · CVSS 4.7 · 1.0% likely

   CWE-434

4. Unrestricted Upload of File with Dangerous Type in EspoCRMCVE-2023-5965EspoCRM · CVSS 4.7 · 1.0% likely

   CWE-434

5. EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin userCVE-2026-33656espocrm · CVSS 9.1 · 0.5% likely

   CWE-22

6. EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and deleteCVE-2026-33733espocrm · CVSS 7.2 · 0.4% likely

   CWE-23

7. EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and deleteCVE-2026-63130espocrm · CVSS 5.5 · 0.3% likely

   CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.