CVE-2026-47168

critical · 9.1

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.

9.1

CVSS

0.4%

EPSS (exploit prob.)

36th

EPSS percentile

2026-10-15

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-502

References

https://github.com/espocrm/espocrm/commit/f48d1d26ffa05eac07ef72bb7f00f67a851184e1
https://github.com/espocrm/espocrm/releases/tag/9.3.7
https://github.com/espocrm/espocrm/security/advisories/GHSA-7q78-jjr9-mqcg

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-47168