An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.
{ "cpes": [ "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*" ], "severity": "High" }