CVE-2026-33534·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 2.0% — higher than 78% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Update PHP and EspoCRM to the latest patched versions immediately, as CVE-2026-33534 allows authenticated users to bypass IP validation through alternative IPv4 notation and access internal services. Upgrade to EspoCRM 9.3.4 or later, which includes fixes for the HostCheck::isNotInternalHost() function to properly reject octal and other non-standard IP representations. Review access logs for suspicious requests to the /api/v1/Attachment/fromImageUrl endpoint using unusual IP formats.

sudo dnf check-update php && sudo dnf upgrade php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /api/v1/Attachment/fromImageUrl HTTP/1.1.*imageUrl=(0177\.0\.0\.1|0x7f\.0\.0\.1|localhost|127\.0\.0\.\d+)|imageUrl=.*%30%31%37%37

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement WAF rules to block POST requests to /api/v1/Attachment/fromImageUrl containing imageUrl parameters with octal (0177), hexadecimal (0x), or localhost values; enforce authentication validation and rate-limit API attachment submissions per authenticated user.

How to check if you are affected

1. Run `php -v` to confirm the installed PHP version and verify EspoCRM version in /app/config/version.php or via admin panel
2. Check if the /api/v1/Attachment/fromImageUrl endpoint is exposed by testing curl -X POST http://target/api/v1/Attachment/fromImageUrl with authentication credentials
3. Search access logs for POST requests to /api/v1/Attachment/fromImageUrl with unusual IP formats (octal notation like 0177, 0x7f, or other alternative representations): `grep -E 'Attachment/fromImageUrl.*0[0-7]{3}' /var/log/apache2/access.log`
4. Verify the patch by checking if EspoCRM version is 9.3.4 or higher: `grep -r 'version' /path/to/espocrm/config/ | grep -E '9\.[3-9]\.[4-9]|9\.[4-9]|[1-9][0-9]\.'`

Indicators of compromise

• POST requests to /api/v1/Attachment/fromImageUrl with octal IP notation (e.g., 0177.0.0.1)
• Attachment API calls originating from authenticated low-privilege accounts accessing internal services
• Log entries showing DNS resolution failures followed by successful cURL connections to loopback addresses

FAQ

Related PHP CVEs

References

• https://github.com/espocrm/espocrm/releases/tag/9.3.4
• https://github.com/espocrm/espocrm/security/advisories/GHSA-h7gx-8gwv-7g73
• https://github.com/espocrm/espocrm/security/advisories/GHSA-h7gx-8gwv-7g73