PT-2026-26442 · Suitecrm · Suitecrm

D3Dn0V4 · Published 2026-03-19 · Updated 2026-05-13 · CVE-2026-29104

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3

Description SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it contains an authenticated arbitrary file upload issue in the Configurator module. An authenticated administrator can bypass file type restrictions when uploading PDF font files, allowing arbitrary files with attacker-controlled filenames to be written to the server. While the upload directory is not directly web-accessible by default, this breaks security boundaries and may enable further attacks when combined with other issues or in certain deployment configurations.

Recommendations SuiteCRM versions prior to 7.15.1 should be updated to version 7.15.1 or later. SuiteCRM versions prior to 8.9.3 should be updated to version 8.9.3 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-29104

GHSA-5HX9-CMMX-26P3

Affected Products

Suitecrm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29104.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-5hx9-cmmx-26p3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29104 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29104 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2034842695013642665 · Twitter Post
• https://twitter.com/CVEnew/status/2034841511087808765 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054621749501632772 · Twitter Post
• https://twitter.com/solomonneas/status/2044385739606020249 · Twitter Post
• https://docs.suitecrm.com/admin/releases/7.15.x · Note