CVE-2026-33534: EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
Affected: espocrm · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 80% of scored CVEs
DescriptionCVE.org
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- espocrm · espocrm< 9.3.4
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- EspoCRM <= 9.3.3 - Server-Side Request Forgery · nuclei template in projectdiscovery/nuclei-templates
- Weakness
- Server-Side Request Forgery
- Vendor
- espocrm
- Published
- April 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-33534 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.