CVE-2026-63130

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.10

Description An authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows path traversal, which enables reading, modifying, creating, or deleting JSON files accessible to the application, depending on filesystem permissions and server configuration. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to version 9.3.10.