{
 "slug": "espocrm",
 "name": "EspoCRM",
 "tagline": "CRM for sales and marketing with email campaigns and workflow automation",
 "category": "business-apps",
 "use_cases": [
  "crm",
  "sales-pipeline",
  "email-campaigns"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "EspoCRM Inc.",
  "url": "https://www.espocrm.com",
  "license": "AGPL-3.0",
  "license_url": "https://github.com/espocrm/espocrm/blob/master/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "10.0.11",
   "last_build": "2026-10-24",
   "offer_id": "esprocrm",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:esprocrm:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.esprocrm?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/espocrm/",
  "json": "https://lynxroute.com/products/espocrm/product.json"
 },
 "release_notes": [
  {
   "version": "10.0.11",
   "title": "EspoCRM 10.0.11",
   "notes": "* EspoCRM updated 10.0.9 -> 10.0.11 on PHP 8.3 + MySQL 8.0 + Nginx, patch releases on the 10.0 line. AGPL-3.0 unchanged\n* Fixes an error message when a status field is changed to a value whose Kanban column is hidden\n* Security: PHP 8.3 updated to 8.3.6-0ubuntu0.24.04.13 (USN-8948-1), fixing the PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-10-24"
   }
  },
  {
   "version": "10.0.9",
   "title": "EspoCRM 10.0.9",
   "notes": "* EspoCRM updated 10.0.8 -> 10.0.9 on PHP 8.3 + MySQL 8.0 + Nginx, a patch release on the 10.0 line. AGPL-3.0 unchanged\n* Security hardening: stricter request content-type checks on formula execution, a stronger script nonce, additional record access checks, and extensions can no longer be installed or removed in restricted mode\n* Fixes personal data erasure for array fields, assignment notifications missing the record name, and the \"only my\" and \"shared\" filters matching records of other entity types\n* Formula fixes: string\\pad counts characters rather than bytes, and datetime\\diff returns the correct sign and whole numbers\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-10-02"
   }
  },
  {
   "version": "10.0.4",
   "title": "EspoCRM 10.0.4",
   "notes": "* EspoCRM 10.0.4 on PHP 8.3 + MySQL 8.0 + Nginx - patch update on the 10.0 line (pipelines, cascading links and record locking). Fixes returning to settings from currency rates, the starred mark not rendering after \"show more\", the Entity Edit button hidden on first load for portal users under account-limited portal roles, and a JS error when adding a list-view field filter with fewer than four filters available\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-19"
   }
  },
  {
   "version": "10.0.3",
   "title": "EspoCRM 10.0.3",
   "notes": "* EspoCRM 10.0.3 on PHP 8.3 + MySQL 8.0 + Nginx - major release (10.0) with new pipelines, cascading links, and record locking\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-07-22"
   }
  },
  {
   "version": "9.3.9",
   "title": "EspoCRM 9.3.9 - June 2026",
   "notes": "* EspoCRM 9.3.9 on PHP 8.3 + MySQL 8.0 + Nginx - maintenance release (patch from 9.3.8)\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {}
  },
  {
   "version": "9.3.8",
   "title": "EspoCRM 9.3.8 - June 2026",
   "notes": "* Maintenance release: bug fixes and stability improvements.\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-06-21"
   }
  },
  {
   "version": "9.3.7",
   "title": "EspoCRM 9.3.7 - May 2026",
   "notes": "* EspoCRM 9.3.7 on Ubuntu 24.04 LTS\n* Maintenance update (patch from 9.3.6)\n",
   "source": "backfill-aws-listing",
   "live": {}
  },
  {
   "version": "9.3.6",
   "title": "EspoCRM 9.3.6 - Initial release (May 2026)",
   "notes": "* EspoCRM 9.3.6 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Per-instance EspoCRM admin password generated on first launch\n* EspoCRM install wizard disabled after the initial setup completes\n* MySQL 8.0 listening on 127.0.0.1 only, with per-instance database password\n* PHP-FPM workers and MySQL InnoDB buffer pool auto-sized to instance RAM at launch\n* Composer vendor dependencies (phpoffice/phpspreadsheet, phpseclib/phpseclib) bumped to the CVE-fixed upstream releases\n* Self-signed TLS certificate generated during the AMI build; HTTP on TCP 80 redirects to HTTPS on TCP 443\n* UFW firewall pre-configured (TCP 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {}
  }
 ],
 "release_history": [
  {
   "version": "10.0.11",
   "azure": "2026-10-24"
  },
  {
   "version": "10.0.9",
   "azure": "2026-10-02"
  },
  {
   "version": "10.0.8",
   "azure": "2026-09-09"
  },
  {
   "version": "10.0.7",
   "azure": "2026-09-06"
  },
  {
   "version": "10.0.4",
   "azure": "2026-08-19"
  },
  {
   "version": "10.0.3",
   "azure": "2026-07-22"
  },
  {
   "version": "9.3.8",
   "azure": "2026-06-21"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer esprocrm --plan payg-gen2\naz vm create -g my-rg -n espocrm --size Standard_D2s_v3 \\\n  --image lynxroute:esprocrm:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "EspoCRM is a self-hosted Customer Relationship Management platform implemented in PHP 8, served by Nginx with PHP-FPM, and persisting every record in MySQL 8.0. It covers the full revenue pipeline - leads, accounts, contacts, opportunities, calendar, tasks, email campaigns, document templates, document storage, reports, and dashboards - with role-based access control, multi-currency support, custom entities and fields, formula scripting, workflow automation, IMAP-aware email-to-record assignment, and a built-in portal feature for granting read-only views to external clients. EspoCRM connects to any standard SMTP relay (Amazon SES, SendGrid, Postmark, Mailgun, or self-hosted Postfix), reads inbound mail over IMAP, supports single sign-on via Google, Microsoft, OpenID Connect and LDAP, and exposes a full REST API for integrations. This image ships the AGPL-3.0 community edition; the image itself is the complete product and runs entirely on the EC2 instance you launch - no external account, subscription, license key, or activation handshake is required. All data stays inside your own AWS account.",
  "image_adds": "Security hardening:\n* Per-instance EspoCRM admin password generated on first launch and written to /root/espocrm-credentials.txt (mode 0600) - never baked into the image\n* EspoCRM install wizard disabled after the initial setup completes (the install/ directory is locked to mode 0000) - no further setup exposure\n* MySQL 8.0 listens on 127.0.0.1 only; the database user password is generated per instance\n* PHP-FPM workers and MySQL InnoDB buffer pool auto-sized to the instance RAM at launch\n* Composer vendor dependencies (phpoffice/phpspreadsheet, phpseclib/phpseclib) bumped to the CVE-fixed upstream releases at build time\n* Self-signed TLS certificate generated during the image build - HTTPS on TCP 443 from launch, HTTP on TCP 80 redirects to HTTPS\n* UFW firewall pre-configured - only TCP 22, 80, 443 are exposed\n* fail2ban with default SSH jail; AppArmor with default Ubuntu profiles\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}