{"id":"CVE-2026-71550","kind":"vulnerability","aliases":["CVE-2026-71550"],"related":[],"title":"SuiteCRM: workflow path traversal lets an authenticated user run server code","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow begins at modules/AOW_WorkFlow/controller.php and uses aow_action, and require_once() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with the WorkFlow role can include executable PHP, obtain server-side code execution, access CRM data and configuration secrets, and establish persistent access. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's workflow controller passes a user-supplied aow_action value into require_once() without restricting the file path. An authenticated user with the WorkFlow role can include and execute arbitrary PHP on the server, reaching CRM data and configuration secrets.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","suitecrm"],"not_affected_if":["managed-hosting","patched-version"],"how_to_check":"- Check the installed SuiteCRM version in the admin console or in the project's version file; versions before `7.15.2` and `8.10.2` are affected.\n- Look for the file `modules/AOW_WorkFlow/controller.php` and check whether it is patched in the installed release.\n- Review which user accounts hold the WorkFlow role.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:26+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","triaged_at":"2026-11-05T19:42:31+00:00","updated_at":"2026-11-05T19:42:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:42:31Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"internet","title":"SuiteCRM: workflow path traversal lets an authenticated user run server code","impact":"high","summary":"SuiteCRM's workflow controller passes a user-supplied aow_action value into require_once() without restricting the file path. An authenticated user with the WorkFlow role can include and execute arbitrary PHP on the server, reaching CRM data and configuration secrets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs PHP code on the server and reads secrets","analyst_note":"Confirm the exact role requirement and whether the WorkFlow role is granted by default, using the linked vendor advisory and patch.","how_to_check":"- Check the installed SuiteCRM version in the admin console or in the project's version file; versions before `7.15.2` and `8.10.2` are affected.\n- Look for the file `modules/AOW_WorkFlow/controller.php` and check whether it is patched in the installed release.\n- Review which user accounts hold the WorkFlow role.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","patched-version"],"who_is_affected":"Any self-hosted SuiteCRM installation before 7.15.2 or 8.10.2 is exposed to a user holding the WorkFlow role, which can be granted to ordinary staff accounts. Teams using only a managed SuiteCRM hosting service should confirm the provider has applied the fix. Installations that restrict who can hold the WorkFlow role have a smaller exposed group but are still affected by the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000781,"input_tokens":4431,"output_tokens":676,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-71550':14A,17A '7.15.2':83C,167C '8.10.2':85C,169C 'access':151C,160C 'action':34B,96C,115C 'affect':107C 'aow':33B,95C,114C 'applic':80C 'arbitrari':55B 'attack':122C 'attacker-control':121C 'authent':7A,45B,135C 'author':126C 'begin':109C 'capabl':94C 'carri':120C 'code':11A,149C 'configur':64B,155C 'constrain':102C 'control':27B,88C,123C 'crm':61B,78C,152C 'custom':75C 'cve':12A,15A 'data':62B,124C,153C 'enterpris':73C 'enterprise-readi':72C 'establish':158C 'execut':54B,143C,150C 'file':42B,105C 'fix':164C 'flow':108C 'host':22B 'includ':52B,142C 'issu':162C 'let':5A 'manag':77C 'modules/aow_workflow/controller.php':111C 'obtain':145C 'open':70C 'open-sourc':69C 'oper':133C 'packag':18B 'pass':28B 'path':3A,43B,92C 'path-traversal-cap':91C 'persist':159C 'php':19B,56B,144C 'prior':81C 'reach':60B 'readi':74C 'relationship':76C 'requir':37B,99C,117C 'resolv':104C 'restrict':40B 'role':50B,140C 'run':9A 'secret':65B,156C 'secur':131C 'security-sensit':130C 'self':21B 'self-host':20B 'sensit':132C 'server':10A,59B,147C 'server-sid':146C 'side':148C 'softwar':79C 'sourc':71C 'state':127C 'suitecrm':1A,23B,24B,66C 'suppli':32B 'travers':4A,93C 'use':89C,113C 'user':8A,31B,46B,136C 'user-suppli':30B 'valu':35B,97C 'version':166C 'without':39B,101C 'workflow':2A,26B,49B,87C,139C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted SuiteCRM installation before 7.15.2 or 8.10.2 is exposed to a user holding the WorkFlow role, which can be granted to ordinary staff accounts. Teams using only a managed SuiteCRM hosting service should confirm the provider has applied the fix. Installations that restrict who can hold the WorkFlow role have a smaller exposed group but are still affected by the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-08-17T16:50:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71550","severity":null,"published_at":"2026-11-05T19:17:26+00:00","modified_at":"2026-11-05T19:17:26+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","fetched_at":"2026-11-05T19:40:38+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79338,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-cx24-rr7r-mxrg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-17T16:50:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}