Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow begins at modules/AOW_WorkFlow/controller.php and uses aow_action, and require_once() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with the WorkFlow role can include executable PHP, obtain server-side code execution, access CRM data and configuration secrets, and establish persistent access. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-11-05T19:17:26.357Z",
  "pubdate": "2026-11-05T19:17:26.357Z",
  "executiveSummary": "A critical path traversal vulnerability exists within the SuiteCRM workflow controller, specifically affecting versions prior to 7.15.2 and 8.10.2. This vulnerability allows an authenticated attacker possessing the WorkFlow role to manipulate the 'aow_action' parameter, leading to unauthorized file inclusion via the require_once() function.\nBy injecting malicious paths, an attacker can execute arbitrary PHP code on the server, facilitating full system compromise. The vulnerability stems from the application's failure to adequately sanitize or constrain user-provided input before using it in security-sensitive filesystem operations. This flaw bypasses intended application boundaries, enabling unauthorized access to CRM data, configuration secrets, and the establishment of persistent backdoors.\nGiven the ability to achieve Remote Code Execution (RCE), the risk level is critical. Successful exploitation requires an authenticated session with specific role-based permissions, but the impact—ranging from data exfiltration to total application takeover—makes this a significant threat to organizational integrity and security.",
  "technicalDetails": "The vulnerability is rooted in an insecure implementation of the workflow management component located in modules/AOW_WorkFlow/controller.php. The application incorrectly trusts the 'aow_action' parameter provided by the user, which is subsequently passed directly into a require_once() statement without prior normalization or validation against a restricted directory whitelist.\nThis behavior facilitates a path traversal attack, allowing an attacker to escape the intended directory structure and include arbitrary files accessible by the web server process. By specifying a file path that the server can parse as PHP, an attacker can trigger the execution of arbitrary code.\nThe attack flow proceeds as follows: First, the attacker must be authenticated and hold sufficient privileges, specifically the WorkFlow role, to access the vulnerable controller. The attacker initiates a request to modules/AOW_WorkFlow/controller.php, crafting the 'aow_action' value to contain path traversal sequences such as '../'. This allows the application to point the require_once() function to a target file—either an existing malicious file uploaded to the server via other means or a sensitive system file whose contents might reveal secrets or be manipulated into executing code.\nOnce the file is included, the server processes its content as PHP, granting the attacker control over the application's execution context. This grants the adversary capabilities including the extraction of the config.php file (containing database credentials and encryption keys), data exfiltration from the CRM database, and the potential for lateral movement within the hosting environment. By including shell-like payloads, the attacker establishes persistent access, ensuring ongoing control regardless of subsequent service restarts.\nThe scope of affected versions includes all SuiteCRM releases prior to 7.15.2 and 8.10.2. The primary failure is the lack of input validation and the dangerous use of dynamic file paths in conjunction with filesystem inclusion primitives. Without a hardcoded whitelist of allowed actions or a restricted base path validation, the software remains susceptible to any input that can be resolved as a local file, thereby enabling remote code execution for any authenticated user with access to the WorkFlow module."
}