CVE-2026-105831GHSA-xfqv-j65r-qqgh
EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form
espocrm espocrm
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 10.0.6espocrmCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record, though Content Security Policy blocks JavaScript execution.
Text from CVE List
Affected versions 2
- espocrmaffected: all versions before 10.0.6CVE List
- espocrmunaffected: 10.0.6CVE List