CVE Details
Basic Information
| Title | EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache |
|---|---|
| Type | cve |
| Published | 2025-08-05T00:17:16.047Z |
| Modified | 2025-08-05T00:17:16.047Z |
Product Information
| Vendor | espocrm |
|---|---|
| Product | espocrm |
| Version | < 9.1.7 |
CVSS Information
| Base Score | 4.5 (MEDIUM) |
|---|---|
| Attack Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H |
AI Analysis
| AI Description | EspoCRM versions below 9.1.7 are vulnerable to access denial via a double slash in the URI, corrupting the router cache and requiring a rebuild to restore functionality. This issue is fixed in version 9.1.7. |
|---|---|
| AI Severity | Medium |
| AI Vendor | EspoCRM Community |
| AI Product | EspoCRM |
| AI Version | versions < 9.1.7 |
Affected Products
- espocrm espocrm < 9.1.7
Additional Information
| CWE List | CWE-444 |
|---|---|
| Source | GitHub_M |
Description
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router’s cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7.