https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:53:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292743 EUVD-2026-292743 https://cve.radiocsirt.org/vuln/euvd-2026-292743 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33656 <p>EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM&#39;s built-in formula scripting engine allowing updating attachment&#39;s sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server&#39;s `open_basedir` scope. Version 9.3.4 fixes the issue.</p> <p>EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM&#39;s built-in formula scripting engine allowing updating attachment&#39;s sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server&#39;s `open_basedir` scope. Version 9.3.4 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33656