CVE-2026-71550 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's workflow controller passes a user-supplied aow_action value into require_once() without restricting the file path. An authenticated user with the WorkFlow role can include and execute arbitrary PHP on the server, reaching CRM data and configuration secrets.
first public Aug 17, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any self-hosted SuiteCRM installation before 7.15.2 or 8.10.2 is exposed to a user holding the WorkFlow role, which can be granted to ordinary staff accounts. Teams using only a managed SuiteCRM hosting service should confirm the provider has applied the fix. Installations that restrict who can hold the WorkFlow role have a smaller exposed group but are still affected by the flaw.
Not affected if managed-hosting, patched-version
Who cares php, self-hosted, suitecrm
7.15.2 and 8.10.2 are affected.modules/AOW_WorkFlow/controller.php and check whether it is patched in the installed release.7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow begins at modules/AOW_WorkFlow/controller.php and uses aow_action, and require_once() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with the WorkFlow role can include executable PHP, obtain server-side code execution, access CRM data and configuration secrets, and establish persistent access. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.