CVE-2026-105831 espocrm CVE debrief

Who should care

Defenders responsible for EspoCRM instances, particularly those using versions earlier than 10.0.6, should assess exposure and potential impact. They should verify exposure, assess potential impact, and prioritize upgrading to version 10.0.6 or later. The vulnerability allows unauthenticated stored HTML injection via Lead Capture Form.

Why it matters

CVE-2026-105831 is a MEDIUM-severity vulnerability in EspoCRM before 10.0.6, allowing unauthenticated stored HTML injection via Lead Capture Form. Defenders should verify exposure, assess potential impact, and prioritize upgrading to version 10.0.6 or later.

• Potential for HTML injection and rendering of malicious content
• Possible disruption of administrator views of log records
• Need for verification of exposure and impact

Technical summary

The vulnerability allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data, which is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record, though Content Security Policy blocks JavaScript execution. Defenders should verify exposure, assess potential impact, and prioritize upgrading to version 10.0.6 or later. The vulnerability has a CVSS score of 5.3 and MEDIUM severity.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on unauthenticated stored HTML injection vulnerabilities.

Recommended defensive actions

• Verify exposure by checking if the EspoCRM instance is running a version earlier than 10.0.6
• Assess potential impact by reviewing the Lead Capture Form configuration and usage
• Implement Content Security Policy to block JavaScript execution
• Upgrade to EspoCRM version 10.0.6 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its CVSS score of 5.3 and MEDIUM severity. The vulnerability allows unauthenticated stored HTML injection via Lead Capture Form. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record, though Content Security Policy blocks JavaScript execution. Defenders should verify exposure, assess potential impact, and prioritize upgrading to version 10.0.6 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.