CVE-2026-33659 | EspoCRM up to 9.3.3 fromImageUrl dns_get_record server-side request forgery

A vulnerability was found in EspoCRM up to 9.3.3. It has been classified as critical. Affected by this issue is the function dns_get_record of the file /api/v1/Attachment/fromImageUrl. The manipulation leads to server-side request forgery.

This vulnerability is referenced as CVE-2026-33659. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is recommended.