CVE-2025-52892
📋 TL;DR
A path traversal vulnerability in EspoCRM versions 9.1.6 and below allows attackers to corrupt the Slim router's cache by accessing URLs with double slashes. This renders the instance unusable until a complete rebuild is performed. All EspoCRM instances running vulnerable versions are affected.
💻 Affected Systems
- EspoCRM
📦 What is this software?
Espocrm by Espocrm
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service - EspoCRM becomes completely inaccessible until manual intervention and cache rebuild.
Likely Case
Temporary service disruption requiring administrator intervention to clear corrupted cache.
If Mitigated
Minimal impact if web server strips double slashes or if using unaffected versions.
🎯 Exploit Status
Requires knowledge of specific URL patterns and depends on web server configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.1.7
Vendor Advisory: https://github.com/espocrm/espocrm/security/advisories/GHSA-26x2-6wch-j8pf
Restart Required: No
Instructions:
1. Backup your EspoCRM instance and database. 2. Download version 9.1.7 or later from the official repository. 3. Replace the existing installation files with the updated version. 4. Clear the cache directory if corruption occurred.
🔧 Temporary Workarounds
Web Server URL Normalization
allConfigure web server (Apache/Nginx) to normalize URLs by removing double slashes before passing to EspoCRM.
For Apache: Use mod_rewrite rules to normalize URLs
For Nginx: Configure location blocks to clean URLs
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block URLs with double slashes.
- Monitor access logs for unusual URL patterns and implement rate limiting.
🔍 How to Verify
Check if Vulnerable:
Check EspoCRM version in admin panel or via composer.json. If version is 9.1.6 or below, the system is vulnerable.Check Version:
Check EspoCRM admin panel or examine composer.json file for version number.Verify Fix Applied:
After upgrading to 9.1.7+, attempt to access EspoCRM with double slashes in URL (e.g., https://domain//#Admin) - system should remain functional.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing double slashes in URLs
- Slim router cache errors or corruption messages
Network Indicators:
- Unusual patterns of requests with double slashes from single IPs
SIEM Query:
web_access_logs WHERE url CONTAINS '//' AND status_code != 404