CVE-2026-53574 | EspoCRM up to 9.3.7 streamAttachments where sql injection

October 15, 2026 Yanac

A vulnerability was found in EspoCRM up to 9.3.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component streamAttachments. Such manipulation of the argument where leads to sql injection.

This vulnerability is uniquely identified as CVE-2026-53574. The attack can be launched remotely. No exploit exists.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More