{"id":"CVE-2026-63130","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-63130","generatedAt":"2026-10-28T02:24:14.039Z","title":"Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration.","description":"EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10.","published":"2026-10-15T15:17:36.000Z","lastModified":"2026-10-15T16:18:19.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L"},"cwe":["CWE-22"],"affected":[],"epss":{"score":0.00335,"percentile":0.26679,"date":"2026-10-26","history":[{"date":"2026-10-16","score":0.00335,"percentile":0.25325}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-15T15:17:36.000Z","detail":{"score":"5.5","severity":"MEDIUM","publishedAt":"2026-10-15T15:17:36.333Z"},"summary":"New CVE, medium severity (CVSS 5.5)."}],"references":[{"url":"https://github.com/espocrm/espocrm/commit/31540a04ca8ea96519c7dbf2d8d2273218e69ce6","source":"security-advisories@github.com"},{"url":"https://github.com/espocrm/espocrm/releases/tag/9.3.10","source":"security-advisories@github.com"},{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-jr5q-25fw-27f8","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-63130","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}