CVE-2026-29103: fallo crítico en SuiteCRM
SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.5%
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary system commands. This vulnerability is a direct Patch Bypass of CVE-2024-49774. Although the vendor attempted to fix the issue in version 7.14.5, the underlying flaw in ModuleScanner.php regarding PHP token parsing remains. The scanner incorrectly resets its internal state ($checkFunction flag) when encountering any single-character token (such as =, ., or ;). This allows attackers to hide dangerous function calls (e.g., system(), exec()) using variable assignments or string concatenation, completely evading the MLP security controls. Versions 7.15.1 and 8.9.3 patch the issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Productos afectados
SuiteCRM · SuiteCRMCVEs relacionadas — SuiteCRM
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-69137HIGHSuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response DisclosureEPSS 3.8%CVE-2026-33289HIGHSuiterCRM has LDAP Filter Injection in Authentication ModuleEPSS 0.7%CVE-2022-50589CRITICALSuiteCRM < 7.12.6 SQL Injection via 'export' FunctionalityEPSS 0.7%CVE-2026-63213HIGHSuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRMEPSS 0.6%CVE-2026-29102HIGHSuiteCRM has Authenticated RCE in ModulesEPSS 0.5%CVE-2025-54788HIGHSuiteCRM: Authenticated Blind SQL Injection in InboundEmail moduleEPSS 0.5%