CVE-2026-63213
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software…
- Risk score
- 43/100
- CVSS
- 7.2 v3.1
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does not reject traversal sequences. An authenticated administrator can copy extracted package …
- Affected
- See advisory
- Fix
- Upgrade the product to 7.15.2 or 8.10.2 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
- https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
- https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
- https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
- https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2
- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-wfvr-mpq2-257w
Original description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does not reject traversal sequences. An authenticated administrator can copy extracted package files outside the intended destination, overwrite application or configuration files, place executable PHP under the web root, or cause denial of service. This issue is fixed in versions 7.15.2 and 8.10.2.
Last activity 5 Nov 2026. Patch Forecast updates every hour.