CVE-2026-33534 | EspoCRM up to 9.3.3 fromImageUrl isNotInternalHost server-side request forgery

A vulnerability, which was classified as critical, has been found in EspoCRM up to 9.3.3. This affects the function HostCheck::isNotInternalHost of the file /api/v1/Attachment/fromImageUrl. This manipulation causes server-side request forgery.

This vulnerability is handled as CVE-2026-33534. The attack can be initiated remotely. There is not any exploit available.

It is advisable to upgrade the affected component.