CVE-2026-100358 · Package
NO FIX YET · SEE WHAT TO DO
The Studio Dropdown Editor in SuiteCRM writes an administrator-supplied dropdown name into a PHP language file without sanitizing it, so injected PHP is saved and included on later page loads. An attacker with administrator access can run code as the web-server account that survives cache clears.
first public Oct 12, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any self-hosted SuiteCRM installation before 7.15.2 or 8.10.2 is affected. Exposure requires an administrator account, since the flaw is in the Studio dropdown editor, so instances where only trusted staff hold admin rights carry less immediate risk, but the injected code persists and runs as the web-server user.
Not affected if managed-hosting, patched-version
Who cares php, self-hosted, suitecrm
7.15.2 and before 8.10.2.custom/ directory, especially language files written by the Studio dropdown editor.7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account, survives cache clears, and compromises application and host confidentiality, integrity, and availability. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.