Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does not reject traversal sequences. An authenticated administrator can copy extracted package files outside the intended destination, overwrite application or configuration files, place executable PHP under the web root, or cause denial of service. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-05T19:17:23.333Z",
  "pubdate": "2026-11-05T19:17:23.333Z",
  "executiveSummary": "SuiteCRM is susceptible to an arbitrary file write vulnerability stemming from insecure path validation within the Upgrade Wizard component.\nThis vulnerability is classified as a Path Traversal issue, allowing an authenticated administrator to manipulate the zip_to_dir parameter during the package commit process.\nBy bypassing the inadequate filtering mechanisms of the clean_path() function, an attacker can influence the filesystem destination of extracted package contents.\nThe impact of this flaw is critical, enabling the overwrite of sensitive application or configuration files, the placement of malicious PHP code within the web root for remote code execution, or the initiation of a denial-of-service condition.\nThis vulnerability affects all SuiteCRM versions prior to 7.15.2 and 8.10.2.\nExploitation requires administrative access to the application, posing a significant risk to the integrity and availability of the CRM environment.\nSuccessful exploitation allows an attacker to achieve full application compromise by manipulating core backend operations through directory traversal sequences.",
  "technicalDetails": "The vulnerability resides within the Upgrade Wizard module of SuiteCRM, specifically within the logic governing the commit flow of uploaded upgrade packages.\nThe root cause is the reliance on the user-supplied, hidden parameter zip_to_dir, which fails to undergo sufficient sanitization before being processed by the system filesystem operations.\nAlthough the software utilizes a clean_path() function intended to neutralize directory traversal sequences (e.g., ../), the implementation is flawed and fails to reject such patterns, allowing them to pass into downstream file handling routines.\nAn authenticated administrator can intercept or craft requests to the Upgrade Wizard where the zip_to_dir parameter contains malicious path traversal sequences. By providing a crafted destination path, the attacker can force the application's file extraction engine to write extracted package files to arbitrary locations outside the intended temporary directory.\nThe attack flow follows a specific progression: First, the attacker uploads a malicious or legitimate upgrade package. Second, during the package commit phase, the attacker modifies the request parameters to include a manipulated zip_to_dir value. Third, because the clean_path() function does not sanitize the traversal input, the backend service uses the attacker-controlled path as the destination root.\nThis behavior permits the attacker to overwrite critical PHP application files, sensitive configuration files (such as config.php), or introduce new, unauthorized executable PHP scripts within the web root directory.\nThe ability to place executable files in the web directory provides a vector for Remote Code Execution (RCE), as the web server will interpret and execute the attacker-supplied scripts upon navigation to the corresponding URI.\nFurthermore, the ability to overwrite critical system files allows an attacker to disable security controls or render the application non-functional, resulting in a denial-of-service. Because the application logic trusts the input implicitly after the ineffective call to clean_path(), the system lacks adequate defense-in-depth measures to prevent unauthorized filesystem modification.\nThis vulnerability is restricted to environments where administrative privileges have already been compromised or obtained, and it is accessible via the administrative interface of the application."
}