{"id":"CVE-2026-55184","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-55184","generatedAt":"2026-10-28T03:30:39.816Z","title":"Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml().","description":"EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.","published":"2026-10-15T15:17:36.000Z","lastModified":"2026-10-15T16:18:13.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":3.5,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"},"cwe":["CWE-79"],"affected":[],"epss":{"score":0.00202,"percentile":0.10031,"date":"2026-10-26","history":[{"date":"2026-10-16","score":0.00202,"percentile":0.09444}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-15T15:17:36.000Z","detail":{"score":"3.5","severity":"LOW","publishedAt":"2026-10-15T15:17:35.777Z"},"summary":"New CVE, low severity (CVSS 3.5)."}],"references":[{"url":"https://github.com/espocrm/espocrm/commit/67223bfb82338c030f38dac03f12c73b7b3d760f","source":"security-advisories@github.com"},{"url":"https://github.com/espocrm/espocrm/releases/tag/9.3.9","source":"security-advisories@github.com"},{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-x5p5-8mxj-9wv6","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-55184","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}