EspoCRM 9.3.3 contains a server-side request forgery (SSRF) vulnerability that allows authenticated users to make requests to internal services, potentially accessing metadata endpoints, internal APIs, or restricted ports.
The bug, tracked as CVE-2026-33534, stems from how the application handles URL processing in its image import functionality. The code fails to properly validate against alternative IPv4 notation formats — things like octal (0177.0.0.1), hex (0x7f.0.0.1), or decimal dword (2130706433) representations of 127.0.0.1. These bypass standard localhost filters.
An attacker sends a crafted URL through the attachment-from-image endpoint using one of these alternative notations. The server then fetches the attacker-controlled URL, which could point to internal services like cloud metadata endpoints (169.254.169.254), internal APIs on non-standard ports, or other resources not meant to be publicly accessible.
The exploit requires valid user credentials, so unauthenticated attack isn’t possible. But in any multi-tenant EspoCRM deployment or instance where untrusted users can create accounts, this is a real concern. The vendor published a security advisory with the GitHub reference GHSA-h7gx-8gwv-7g73.
Upgrade to a patched version. If you can’t patch immediately, restrict outbound network access from the EspoCRM server to limit what an SSRF can reach.
