Vulnerability details
CVE-2026-63213
SuiteCRM SuiteCRM
SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM
CVSS 3.1
7.2High
Official description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does not reject traversal sequences. An authenticated administrator can copy extracted package files outside the intended destination, overwrite application or configuration files, place executable PHP under the web root, or cause denial of service. This issue is fixed in versions 7.15.2 and 8.10.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.2High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SuiteCRM | SuiteCRM | < 7.15.2 | CVEProject cvelistV5 (CNA) |
| SuiteCRM | SuiteCRM | >= 8.0.0, < 8.10.2 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-wfvr-mpq2-257w x_refsource_CONFIRM
- https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68 x_refsource_MISC
- https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c x_refsource_MISC
- https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2 x_refsource_MISC
- https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-05
- Last updated
- 2026-11-05
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.55%
Probability of exploitation in 30 days
46.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')