An authenticated path traversal vulnerability in EspoCRM allows high-privileged users to perform unauthorized file operations, posing a significant risk to system integrity and confidentiality.

This is a relative path traversal vulnerability (CWE-23) located in the admin template management endpoints. An attacker with authenticated administrator privileges can supply malicious input to the name and scope parameters to escape the intended directory and manipulate files on the underlying filesystem.

The ability to read, overwrite, or delete arbitrary files on the web server can lead to a total compromise of the application environment. Given the CVSS score of 7.2, this vulnerability represents a high risk to business operations, as it could facilitate the theft of sensitive customer data, the injection of malicious code, or the complete denial of service through file deletion.

Immediate Action: Upgrade to EspoCRM version 9.3.4 or later to apply the necessary path normalization and input validation fixes.

Proactive Monitoring: Review web server access logs for anomalous requests to administrative endpoints, specifically looking for directory traversal patterns such as "../" sequences.

Compensating Controls: Ensure that the web application process runs with the least privilege necessary, restricting its ability to access files outside of the defined application directory.

Public Exploit Available: Unknown

Organizations utilizing EspoCRM must prioritize the update to version 9.3.4 immediately. Because this vulnerability grants administrative users the power to modify or delete core system files, the potential for catastrophic failure or data exfiltration is high. Administrators should also audit existing user accounts for signs of unauthorized activity or privilege misuse following the update.