Path Traversal Vulnerability in SuiteCRM Affects Execution of Unauthorized PHP Code

CVE-2026-71550

What is CVE-2026-71550?

SuiteCRM, an open-source Customer Relationship Management software, contains a vulnerability prior to versions 7.15.2 and 8.10.2 that exposes the application to a path traversal issue. This allows an authenticated user with a specific role to exploit the workflow controller. By manipulating the 'aow_action' value in the 'require_once()' function, attackers can introduce unauthorized PHP code execution, potentially gaining access to sensitive CRM data, configuration secrets, and establishing persistent access to the system. The vulnerability emphasizes the necessity for updates to versions 7.15.2 and 8.10.2 to mitigate risks.

References