CVE-2026-63130 espocrm CVE debrief

Who should care

Administrators and users of EspoCRM versions prior to 9.3.10 should assess exposure and prioritize upgrading to the fixed version. This includes reviewing current version and exposure to vulnerability, verifying administrative access to LabelManager, and monitoring for suspicious activity on `.json` files. Security teams should review compensating controls and ensure proper change control for updates.

Why it matters

CVE-2026-63130 is a medium-severity path traversal vulnerability in EspoCRM's LabelManager, allowing authenticated administrators to read, write, and delete arbitrary `.json` files. Administrators should prioritize upgrading to version 9.3.10 to prevent potential data tampering and disruption of application functionality.

• Potential data tampering or unauthorized access to sensitive data
• Possible disruption of application functionality or data integrity
• Need for verification of current version and exposure to vulnerability
• Priority on upgrading to fixed version 9.3.10

Technical summary

The vulnerability allows an authenticated administrator to provide crafted input to the Label Manager, enabling traversal outside the intended directory and permitting reading, modifying, creating, or deleting JSON files accessible to the application. This issue has been fixed in version 9.3.10. The vulnerability has a medium severity and can lead to potential data tampering or disruption of application functionality. The CVE record and source item provide details on the vulnerability, its impact, and the fixed version.

Defensive priority

Administrators should prioritize upgrading to version 9.3.10 to prevent potential data tampering.

Recommended defensive actions

• Upgrade to version 9.3.10 or later
• Review and restrict administrative access to LabelManager
• Monitor for suspicious activity on `.json` files
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fixed version. The vulnerability has been confirmed and affects EspoCRM versions prior to 9.3.10. The source item and CVE record provide source-provided CVE metadata and official vulnerability details. Defenders should verify current version and exposure to vulnerability, review compensating controls, and monitor for suspicious activity on `.json` files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.