Path Traversal Vulnerability in SuiteCRM Affects Multiple Versions

CVE-2026-29098

What is CVE-2026-29098?

The action_exportCustom function in SuiteCRM prior to versions 7.15.1 and 8.9.3 is susceptible to path traversal due to insufficient validation of user inputs in the $modules and $name parameters. This vulnerability allows unauthorized users, particularly those with administrator access to the ModuleBuilder module, to manipulate requests and access arbitrary files on the server. An attacker could exploit this flaw to copy sensitive data from any readable directory, such as /etc, into the web root, thereby risking exposure of critical information, such as system files and environment variables. Versions 7.15.1 and 8.9.3 address and mitigate this vulnerability.

References