---
cve: "CVE-2026-88896"
severity: "MEDIUM"
cvss: 6.9
epss: "0.3%"
vendor: "espocrm"
kev: false
exploited: false
published: "2026-09-10 14:17:19"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-20T20:05:51+02:00"
---

# CVE-2026-88896

> 6.9 MEDIUM · 🧪 PoC

## Beschreibung

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services. Affected paths include POST /Attachment/fromImageUrl, reachable by any authenticated user with attachment access, and outbound webhook delivery, which requires an admin or API user.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Patch verfügbar (OSV)

- 0a50f3a37c8e2d96c0746a07ff698c9ef1c0c3aa (Commit)

## Referenzen

- <https://github.com/espocrm/espocrm/security/advisories/GHSA-xwmh-j8hf-cfqw>
- <https://www.vulncheck.com/advisories/espocrm-before-10.0.4-ssrf-via-ipv6-transition-address-bypass>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-88896) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_