File Traversal Vulnerability in SuiteCRM Affects User Data and Configuration
CVE-2026-63213
7.2HIGH
What is CVE-2026-63213?
SuiteCRM is an open-source CRM solution that contains a vulnerability related to file traversal in the Upgrade Wizard commit flow. This issue arises when the hidden 'zip_to_dir' parameter is not properly validated by the clean_path() function. Consequently, an authenticated administrator can exploit this flaw to copy extracted package files beyond the intended directories. This could lead to the overwriting of critical application or configuration files, placement of executable PHP scripts in the web root, or a denial of service, compromising the security and availability of the application. The vulnerability has been addressed in versions 7.15.2 and 8.10.2.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2