CVE-2023-5965

Name of the Vulnerable Software and Affected Versions EspoCRM version 7.2.5

Description An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server via the update form, which could lead to arbitrary PHP code execution.

Recommendations For EspoCRM version 7.2.5, update to a version that contains a fix for this issue to prevent arbitrary PHP code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the update form to minimize the risk of exploitation.