CVE-2026-61649

A race condition in SuiteCRM before version 7.2.3 allows remote attackers to execute arbitrary code. This vulnerability exists due to an incomplete fix for CVE-2015-5947.

SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.

An incomplete blacklist vulnerability in SuiteCRM version 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.

In SuiteCRM before 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. An authenticated user with the WorkFlow role can include executable PHP and achieve server-side code execution.

In SuiteCRM before 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account.

A SQL injection vulnerability in SuiteCRM versions prior to 7.12.6 exists in the processing of the 'uid' parameter within the export functionality. Remote unauthenticated attackers can exploit this flaw to execute arbitrary code.

In SuiteCRM before 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection.

In SuiteCRM before 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database.

In SuiteCRM prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents.

In SuiteCRM prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean and the revision is served without checking its parent document. A low-privileged authenticated user can download administrator-owned or otherwise protected documents.