Read the docs
TI-2025-23468 Aliases CVE-2025-32390

EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover

Priority HIGH 66CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to complete page defacement imitating the login page. Authenticated users with the read knowledge article privilege can browse to the KB article and if they submit their credentials, they get captured in plain text. The vulnerability is allowed by overly permissive HTML editing being allowed on the KB articles. Any authenticated user with the privilege to read KB articles is impacted. In an enterprise with multiple applications, the malicious KB article could be edited to match the login pages of other applications, which would make it useful for credential harvesting against other applications as well. Version 9.0.8 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed espocrm (espocrm): 9.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
espocrmespocrmbefore 9.0.89.0.8Patch availableCNA
  • espocrm Vendorespocrm Affected before 9.0.8 Fixed in 9.0.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*before 9.0.8Vulnerableespocrm
  • cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:* Versions before 9.0.8 Vulnerable ·espocrm

Remediation

  • Fix · CNA espocrm (espocrm) Fixed in 9.0.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32390

References

Exploit 1

Patch 1

  • TI-2020-19229 EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords CVSS 4.0HIGH 8.6
  • TI-2026-26036 Path traversal in espocrm CVSS 3.1CRITICAL 9.1
  • TI-2025-32670 EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements CVSS 3.1MEDIUM 6.5
  • TI-2026-26112 EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete CVSS 3.1HIGH 7.2
  • TI-2024-16335 EspoCRM weakness in "Forgot password" CVSS 3.1MEDIUM 5.9
  • TI-2026-26119 EspoCRM: Email importEml can import and delete another user's attachment by raw fileId CVSS 3.1MEDIUM 5.4
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences