---
id: CVE-2026-55184
title: EspoCRM is an open source customer relationship management application
summary: >-
  EspoCRM is an open source customer relationship management application. Prior
  to 9.3.9, a user with Email Template or PDF Template edit permission can store
  crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the
  t…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N'
cwe:
  - CWE-79
vendor: espocrm
product: espocrm
affected:
  - espocrm < 9.3.9
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:18:13.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55184'
references:
  - url: >-
      https://github.com/espocrm/espocrm/commit/67223bfb82338c030f38dac03f12c73b7b3d760f
    label: security-advisories@github.com
  - url: 'https://github.com/espocrm/espocrm/releases/tag/9.3.9'
    label: security-advisories@github.com
  - url: 'https://github.com/espocrm/espocrm/security/advisories/GHSA-x5p5-8mxj-9wv6'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T15:46:12.655435Z'
ingestedAt: '2026-10-15T15:09:08.429Z'
---

## Overview

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.