{"id":"CVE-2026-47168","published":"2026-10-15T15:17:34.917","lastModified":"2026-10-15T15:17:35.037","description":"EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://github.com/espocrm/espocrm/commit/f48d1d26ffa05eac07ef72bb7f00f67a851184e1","tags":[]},{"url":"https://github.com/espocrm/espocrm/releases/tag/9.3.7","tags":[]},{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7q78-jjr9-mqcg","tags":[]}],"exploitRefs":[{"url":"https://github.com/espocrm/espocrm/commit/f48d1d26ffa05eac07ef72bb7f00f67a851184e1","tags":[]},{"url":"https://github.com/espocrm/espocrm/releases/tag/9.3.7","tags":[]},{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7q78-jjr9-mqcg","tags":[]}],"hasPoc":true,"ai":{"summary":"EspoCRM's authenticated administrator can trigger arbitrary code execution through deserialization of crafted PHP objects in background processes. This allows attackers to execute server-side code with administrator privileges.","exploitability":"Exploitation requires an authenticated administrator account with access to MassAction or Export functionality, making it moderately difficult but achievable for attackers who gain administrative access.","blast_radius":"The vulnerability could impact organizations using EspoCRM 9.3.6 or earlier, potentially allowing full server compromise and data exfiltration across all customer relationship management data.","remediation":"Upgrade to version 9.3.7 immediately","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","web","php"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:48:40.034Z"}}