PT-2026-26445 · Suitecrm · Suitecrm

Parnuski · Publicado 2026-03-19 · Atualizado 2026-03-20 · CVE-2026-29107

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3

Description SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it was possible to create PDF templates containing <img> tags. When a PDF is exported using these templates, the content is rendered server-side, leading to a Server-Side Request Forgery (SSRF). Specifically, a crafted <img> tag, such as <img src=http://{burp collaborator url}>, causes the server to make a request to the specified URL.

Recommendations Update SuiteCRM to version 7.15.1 or later. Update SuiteCRM to version 8.9.3 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-29107

GHSA-G7CV-4GHJ-X98H

Produtos afetados

Suitecrm

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29107.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-g7cv-4ghj-x98h · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-29107 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-29107 · Aviso do Fabricante
• https://docs.suitecrm.com/admin/releases/7.15.x · Nota
• https://twitter.com/CVEnew/status/2034841506113355794 · Publicação no Twitter