How severe is CVE-2023-46736?

CVE-2023-46736 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2023-46736 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-46736?

CVE-2023-46736 affects Espocrm. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-46736?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-46736 published?

CVE-2023-46736 was published on 2023-12-05 and last updated on 2026-06-17.

CVE-2023-46736

CVE-2023-46736 is a medium-severity vulnerability in Espocrm with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-918.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (28th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-918
Affected product: Espocrm
Published: 2023-12-05
Last modified: 2026-06-17

Description

EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via the upload image from url api. Users who have access to `the /Attachment/fromImageUrl` endpoint can specify URL to point to an internal host. Even though there is check for content type, it can be bypassed by redirects in some cases. This SSRF can be leveraged to disclose internal information (in some cases), target internal hosts and bypass firewalls. This vulnerability has been addressed in commit `c536cee63` which is included in release version 8.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Frequently asked questions

What is CVE-2023-46736?: EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via the upload image from url api. Users who have access to `the /Attachment/fromImageUrl` endpoint can specify URL to point to an internal host. Even though there is check for content type, it can be bypassed by redirects in some cases. This SSRF can be leveraged to disclose internal information (in some cases), target internal hosts and bypass firewalls. This vulnerability has been addressed in commit `c536cee63` which is included in release version 8.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
How severe is CVE-2023-46736?: CVE-2023-46736 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2023-46736 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-46736?: CVE-2023-46736 affects Espocrm. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-46736?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-46736 published?: CVE-2023-46736 was published on 2023-12-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*

More vulnerabilities in Espocrm

CVE-2014-7985 — Critical (CVSS 10.0): Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary…
CVE-2020-37094 — Critical (CVSS 9.8): EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by…
CVE-2026-33656 — Critical (CVSS 9.1): EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in…
CVE-2022-38843 — High (CVSS 8.8): EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any…
CVE-2019-14351 — High (CVSS 8.8): EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a…
CVE-2025-32390 — High (CVSS 8.5): EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in…

All CVEs affecting Espocrm →

Other CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities

CVE-2026-47938 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)…
CVE-2026-35431 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to…
CVE-2026-32186 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a…
CVE-2026-33107 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a…
CVE-2026-32871 — Critical (CVSS 10.0): FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP…
CVE-2026-32169 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a…

Browse all CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities →