{"id":"CVE-2026-100358","kind":"vulnerability","aliases":["CVE-2026-100358"],"related":[],"title":"SuiteCRM: admin dropdown editor writes PHP that runs on every page","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account, survives cache clears, and compromises application and host confidentiality, integrity, and availability. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"The Studio Dropdown Editor in SuiteCRM writes an administrator-supplied dropdown name into a PHP language file without sanitizing it, so injected PHP is saved and included on later page loads. An attacker with administrator access can run code as the web-server account that survives cache clears.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","suitecrm"],"not_affected_if":["managed-hosting","patched-version"],"how_to_check":"- Check the installed SuiteCRM version in the application's admin or version file; affected versions are before `7.15.2` and before `8.10.2`.\n- Look for unexpected PHP content in files under the `custom/` directory, especially language files written by the Studio dropdown editor.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:16:55+00:00","first_seen_at":"2026-11-05T19:40:34+00:00","triaged_at":"2026-11-05T19:42:30+00:00","updated_at":"2026-11-05T19:42:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T19:42:30Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"internet","title":"SuiteCRM: admin dropdown editor writes PHP that runs on every page","impact":"high","summary":"The Studio Dropdown Editor in SuiteCRM writes an administrator-supplied dropdown name into a PHP language file without sanitizing it, so injected PHP is saved and included on later page loads. An attacker with administrator access can run code as the web-server account that survives cache clears.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs persistent PHP code as the web-server account","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the application's admin or version file; affected versions are before `7.15.2` and before `8.10.2`.\n- Look for unexpected PHP content in files under the `custom/` directory, especially language files written by the Studio dropdown editor.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","patched-version"],"who_is_affected":"Any self-hosted SuiteCRM installation before 7.15.2 or 8.10.2 is affected. Exposure requires an administrator account, since the flaw is in the Studio dropdown editor, so instances where only trusted staff hold admin rights carry less immediate risk, but the injected code persists and runs as the web-server user.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000733,"input_tokens":4385,"output_tokens":588,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-100358':14A,17A '-2026':13A,16A '7.15.2':91C,156C '8.10.2':93C,158C 'access':60B 'account':69B,137C 'admin':2A 'administr':33B,59B,125C 'administrator-suppli':32B 'applic':88C,143C 'attack':57B 'avail':149C 'cach':72B,139C 'clear':73B,140C 'code':63B 'compromis':142C 'confidenti':146C 'crm':86C 'custom':83C,116C 'cve':12A,15A 'decod':104C 'dropdown':3A,26B,35B,96C,99C 'editor':4A,27B,97C 'enterpris':81C 'enterprise-readi':80C 'entiti':103C 'everi':10A 'execut':131C 'file':41B,114C 'fix':153C 'host':22B,145C 'html':102C 'includ':51B,119C 'inject':46B,127C 'integr':147C 'issu':151C 'languag':40B,113C 'later':53B,121C 'load':55B,123C 'manag':85C 'name':36B,100C 'open':78C 'open-sourc':77C 'packag':18B 'page':11A,54B,122C 'pass':98C 'persist':128C 'php':6A,19B,39B,47B,112C,129C 'prior':89C 'readi':82C 'relationship':84C 'result':108C 'run':8A,62B 'sanit':43B 'save':49B 'self':21B 'self-host':20B 'server':68B,136C 'softwar':87C 'sourc':79C 'studio':25B,95C 'suitecrm':1A,23B,29B,74C 'suppli':34B 'surviv':71B,138C 'verbatim':109C 'version':155C 'web':67B,135C 'web-serv':66B,134C 'without':42B 'write':5A,30B,106C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted SuiteCRM installation before 7.15.2 or 8.10.2 is affected. Exposure requires an administrator account, since the flaw is in the Studio dropdown editor, so instances where only trusted staff hold admin rights carry less immediate risk, but the injected code persists and runs as the web-server user.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-10-12T17:45:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100358","severity":null,"published_at":"2026-11-05T19:16:55+00:00","modified_at":"2026-11-05T19:16:57+00:00","first_seen_at":"2026-11-05T19:40:34+00:00","fetched_at":"2026-11-05T19:40:34+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79139,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-4773-c8fh-3rww","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-12T17:45:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}