Persistent PHP Injection in SuiteCRM by SalesAgility
CVE-2026-100358
9.4CRITICAL
What is CVE-2026-100358?
In SuiteCRM, prior to versions 7.15.2 and 8.10.2, the Studio Dropdown Editor is susceptible to a vulnerability allowing an administrator to execute arbitrary PHP code. By injecting code through the $dropdown_name variable, malicious actors can create persistent PHP scripts stored within the application's custom PHP files. This vulnerability compromises the integrity, confidentiality, and availability of both the application and the host server, as the injected code executes with the same permissions as the web server. Users of SuiteCRM are advised to upgrade to the fixed versions to mitigate potential risks.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2