Vulnerability details

CVE-2026-100358

SuiteCRM SuiteCRM

SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

CVSS 4.0

9.4Critical

Official description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account, survives cache clears, and compromises application and host confidentiality, integrity, and availability. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS scores

Score	Version	Source	Vector
9.4Critical	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

Affected products

Vendor	Product	Versions	Source
SuiteCRM	SuiteCRM	< 7.15.2	CVEProject cvelistV5 (CNA)
SuiteCRM	SuiteCRM	>= 8.0.0, < 8.10.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-4773-c8fh-3rww x_refsource_CONFIRM
https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68 x_refsource_MISC
https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c x_refsource_MISC
https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2 x_refsource_MISC
https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-05
Last updated: 2026-11-05
State: Published
Assigner (CNA): GitHub_M
Kolun priority: 22 · Low

Exploit prediction (EPSS)

0.37%

Probability of exploitation in 30 days

31.1%

Percentile (among all CVEs)

Weaknesses (CWE)

CWE-94
Improper Control of Generation of Code ('Code Injection')