CVE-2026-33659: SSRF in EspoCRM 9.3.3 and Below

The SSRF vulnerability in EspoCRM allows an attacker to craft a malicious request through the /api/v1/Attachment/fromImageUrl endpoint. Due to a TOCTOU (Time-of-Check-Time-of-Use) condition, the hostname validation process, which relies on dnsgetrecord(), can return a different IP address than the one used by curl's internal resolver (gethostbyname()). This discrepancy enables an attacker to bypass hostname restrictions and potentially access internal services or external resources that should be inaccessible. Successful exploitation could lead to information disclosure, unauthorized access to internal systems, or even remote code execution if the SSRF can be chained with other vulnerabilities. The DNS rebinding technique amplifies the risk, allowing attackers to dynamically change the target IP address during the request lifecycle.

1. Reserved2026-03-23
2. Published2026-04-13
3. Modified2026-04-14
4. EPSS updated2026-04-21

The primary mitigation for CVE-2026-33659 is to upgrade EspoCRM to version 9.3.4 or later, which includes the necessary fixes. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict outbound network access from the EspoCRM server using a Web Application Firewall (WAF) or proxy to limit the potential impact of SSRF requests. Specifically, block requests to unusual or unexpected hostnames. Review and strengthen hostname validation logic within the application if possible, although this is a complex undertaking. After upgrading, confirm the vulnerability is resolved by attempting to trigger the /api/v1/Attachment/fromImageUrl endpoint with a known malicious hostname and verifying that the request is blocked or fails as expected.