https://github.com/espocrm/espocrm/releases/tag/9.3.3 · EspoCRM 9.3.3 · SSRF
Affects https://github.com/espocrm/espocrm/releases/tag/9.3.3Source Exploit-DB RSS Feed
Public exploit available (Exploit-DB).
Data as of 29 Oct 2026, 19:04 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 1.9% chance of exploitation in 30 days – higher than 80% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: evidence found.
nuclei template: EspoCRM <= 9.3.3 - Server-Side Request Forgery
Weaponized: evidence found.
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| https://www.espocrm.com https://github.com/espocrm/espocrm/releases/tag/9.3.3 | Affected
| Fixed in– |
AI-suggested
Until an official fix is available, consider restricting outbound HTTP requests from the EspoCRM server or implementing network-level controls to limit the impact of SSRF attempts.
Description
EspoCRM 9.3.3 - SSRF
Indicators of compromise
Exploit source code
# Exploit Title: EspoCRM 9.3.3 - Authenticated SSRF via Alternative IPv4 Notation
# Google Dork: N/A
# Date: 2026-05-08
# Exploit Author: Max Gabriel (https://github.com/EntroVyx)
# Vendor Homepage: https://www.espocrm.com/
# Software Link: https://github.com/espocrm/espocrm/releases/tag/9.3.3
# Version: 9.3.3
# Tested on: EspoCRM 9.3.3, Debian/Kali, Apache/PHP
# CVE : CVE-2026-33534
# Advisory: https://github.com/espocrm/espocrm/security/advisories/GHSA-h7gx-8gwv-7g73
#
# Usage:
# python3 CVE…