CVE-2026-88896

    Dashboard / Vulnerabilities / CVE-2026-88896

    CVE-2026-88896

    Published: 10 Sept 2026Last Modified: 11 Sept 2026

    Summary: EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

    Details: EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services. Affected paths include POST /Attachment/fromImageUrl, reachable by any authenticated user with attachment access, and outbound webhook delivery, which requires an admin or API user.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88896.json, https://github.com/espocrm/espocrm/security/advisories/GHSA-xwmh-j8hf-cfqw, https://nvd.nist.gov/vuln/detail/CVE-2026-88896, https://www.vulncheck.com/advisories/espocrm-before-10.0.4-ssrf-via-ipv6-transition-address-bypass

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0a50f3a37c8e2d96c0746a07ff698c9ef1c0c3aa

    Affected versions

    10.0.3
    10.0.2
    10.0.1
    10.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-88896 | CVE-DB