CVE-2026-63213 · Runtime
NO FIX YET · SEE WHAT TO DO
SuiteCRM's Upgrade Wizard trusts a hidden zip_to_dir parameter and does not reject path traversal sequences, so an authenticated administrator can copy package files outside the intended folder. An attacker can overwrite application or configuration files, place executable PHP under the web root, or cause a denial of service.
first public Jul 31, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted SuiteCRM instances before 7.15.2 or 8.10.2 are exposed, and only accounts with administrator rights can reach the Upgrade Wizard commit flow. Instances on managed hosting that the vendor patches, or deployments that restrict admin access tightly, carry less risk, but the sources do not say which hosts have been patched.
Not affected if managed-hosting, non-admin-only-access
Who cares crm, php, self-hosted, suitecrm
7.15.2 and 8.10.2 are the fixed releases7.15.2 or later8.10.2 or laterSuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does not reject traversal sequences. An authenticated administrator can copy extracted package files outside the intended destination, overwrite application or configuration files, place executable PHP under the web root, or cause denial of service. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.