PT-2025-32317 · Suitecrm · Suitecrm

Paul1278 · Published 2025-08-07 · Updated 2025-08-12 · CVE-2025-54787

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM version 7.14.6

Description SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability exists that allows unauthenticated downloads of any file from the upload-directory, provided the file is named using an ID (e.g., attachments). An unauthenticated attacker could download internal files by discovering a valid file-ID. Valid IDs could be brute-forced, although this may be time-consuming as the file-IDs are typically UUIDs.

Recommendations Upgrade to SuiteCRM version 7.14.7 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-54787

GHSA-8R72-224Q-G9FV

Affected Products

Suitecrm

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54787.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-8r72-224q-g9fv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54787 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54787 · Vendor Advisory
• https://twitter.com/CVEnew/status/1953570714034036765 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1953690406056558711 · Twitter Post
• https://t.me/cveNotify/131346 · Telegram Post
• https://t.me/CVEtracker/29474 · Telegram Post
• https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7 · Note
• https://t.me/cveNotify/131515 · Telegram Post
• https://t.me/cveNotify/131958 · Telegram Post