CVE-2026-100358 SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

CriticalCVSS 9.4

Published: 2026-11-05 20:47
Updated: 2026-11-10 00:37
Exploit status: No public exploit known

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account, survives cache clears, and compromises application and host confidentiality, integrity, and availability. This issue is fixed in versions 7.15.2 and 8.10.2.

Affected products

Product	Affected versions	Fixed in
SuiteCRM	= < 7.15.2	No fix listed
SuiteCRM	= >= 8.0.0, < 8.10.2	No fix listed

References

CVSS v4.0

9.4 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: High
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: High

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.