CVE-2023-5966

Name of the Vulnerable Software and Affected Versions EspoCRM version 7.2.5

Description An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server via the extension deployment form, which could lead to arbitrary PHP code execution.

Recommendations For EspoCRM version 7.2.5, update to a newer version that contains a fix for this issue to prevent arbitrary PHP code execution. As a temporary workaround, consider restricting access to the extension deployment form to minimize the risk of exploitation.