CVE-2026-126306 | EspoCRM up to 9.3.10/10.0.7 SVG Image cross site scripting

November 13, 2026 Yanac

A vulnerability marked as problematic has been reported in EspoCRM up to 9.3.10/10.0.7. This vulnerability affects unknown code of the component SVG Image Handler. The manipulation leads to cross site scripting.

This vulnerability is traded as CVE-2026-126306. It is possible to initiate the attack remotely. There is no exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More