{"id":"CVE-2026-63213","kind":"vulnerability","aliases":["CVE-2026-63213"],"related":[],"title":"SuiteCRM: Upgrade Wizard path traversal lets an admin write files outside the destination","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does not reject traversal sequences. An authenticated administrator can copy extracted package files outside the intended destination, overwrite application or configuration files, place executable PHP under the web root, or cause denial of service. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's Upgrade Wizard trusts a hidden zip_to_dir parameter and does not reject path traversal sequences, so an authenticated administrator can copy package files outside the intended folder. An attacker can overwrite application or configuration files, place executable PHP under the web root, or cause a denial of service.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","php","runtime","self-hosted","suitecrm"],"not_affected_if":["managed-hosting","non-admin-only-access"],"how_to_check":"- Check the installed SuiteCRM version in the admin console or in the application files; `7.15.2` and `8.10.2` are the fixed releases\n- Confirm whether administrators can reach the Upgrade Wizard on your instance","fix":"- SuiteCRM 7.x: move to `7.15.2` or later\n- SuiteCRM 8.x: move to `8.10.2` or later","status":"open","published_at":"2026-11-05T19:17:23+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","triaged_at":"2026-11-05T19:43:04+00:00","updated_at":"2026-11-05T19:43:04+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T19:43:04Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2` or later\n- SuiteCRM 8.x: move to `8.10.2` or later","reach":"internet","title":"SuiteCRM: Upgrade Wizard path traversal lets an admin write files outside the destination","impact":"high","summary":"SuiteCRM's Upgrade Wizard trusts a hidden zip_to_dir parameter and does not reject path traversal sequences, so an authenticated administrator can copy package files outside the intended folder. An attacker can overwrite application or configuration files, place executable PHP under the web root, or cause a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["suitecrm","self-hosted","php","crm"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker writes executable PHP under the web root, enabling code execution","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the admin console or in the application files; `7.15.2` and `8.10.2` are the fixed releases\n- Confirm whether administrators can reach the Upgrade Wizard on your instance","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","non-admin-only-access"],"who_is_affected":"Self-hosted SuiteCRM instances before 7.15.2 or 8.10.2 are exposed, and only accounts with administrator rights can reach the Upgrade Wizard commit flow. Instances on managed hosting that the vendor patches, or deployments that restrict admin access tightly, carry less risk, but the sources do not say which hosts have been patched.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4376,"output_tokens":620,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-63213':16A,19A '7.15.2':95C,153C '8.10.2':97C,155C 'admin':8A 'administr':48B,120C 'applic':61B,92C,131C 'attack':58B 'authent':47B,119C 'caus':73B,143C 'clean':111C 'commit':101C 'configur':63B,133C 'copi':50B,122C 'crm':20B,90C 'custom':87C 'cve':14A,17A 'denial':75B,144C 'destin':13A,129C 'dir':36B,108C 'enterpris':85C 'enterprise-readi':84C 'execut':66B,136C 'extract':123C 'file':10A,52B,64B,125C,134C 'fix':150C 'flow':102C 'folder':56B 'hidden':33B,105C 'host':25B 'intend':55B,128C 'issu':148C 'let':6A 'manag':89C 'open':82C 'open-sourc':81C 'outsid':11A,53B,126C 'overwrit':60B,130C 'packag':51B,124C 'paramet':37B,109C 'path':4A,42B,112C 'php':21B,67B,137C 'place':65B,135C 'prior':93C 'readi':86C 'reject':41B,115C 'relationship':88C 'root':71B,141C 'runtim':22B 'self':24B 'self-host':23B 'sequenc':44B,117C 'servic':77B,146C 'softwar':91C 'sourc':83C 'suitecrm':1A,26B,27B,78C 'travers':5A,43B,116C 'trust':31B,103C 'upgrad':2A,29B,99C 'version':152C 'web':70B,140C 'wizard':3A,30B,100C 'write':9A 'zip':34B,106C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted SuiteCRM instances before 7.15.2 or 8.10.2 are exposed, and only accounts with administrator rights can reach the Upgrade Wizard commit flow. Instances on managed hosting that the vendor patches, or deployments that restrict admin access tightly, carry less risk, but the sources do not say which hosts have been patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","high","php","runtime","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-07-31T14:37:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63213","severity":null,"published_at":"2026-11-05T19:17:23+00:00","modified_at":"2026-11-05T19:17:23+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","fetched_at":"2026-11-05T19:40:37+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79263,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-wfvr-mpq2-257w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T14:37:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}