Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-113643

EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulDB

Description

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a EspoCRM

  • 9.3.0affected
  • 9.3.1affected
  • 9.3.2affected
  • 9.3.3affected
  • 9.3.4affected
  • 9.3.5affected
  • 9.3.6affected
  • 9.3.7affected
  • 9.3.8affected
  • 9.3.9affected
  • 9.3.10affected
  • 10.0.0affected
  • 10.0.1affected
  • 10.0.2affected
  • 10.0.3affected
  • 10.0.4affected
  • 10.0.5affected
  • 10.0.6affected
  • 10.0.7affected
  • 10.0.8affected
  • 10.0.9affected
  • 10.0.10affected

References