VYPR
← All advisories
High severity8.0NVD Advisory· Published Sep 16, 2022· Updated Jun 17, 2026

CVE-2022-38844

CVE-2022-38844

Description

CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.

Affected products

4
  • Espocrm/Espocrm3 versions
    cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*
    • (no CPE)
    • (no CPE)range: 7.1.8
  • osv-coords
    pkg:bitnami/espocrm
    Range: >= 7.1.8, <= 7.1.8

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.