PT-2026-26445 · Suitecrm · Suitecrm

Parnuski · CVE-2026-29107 · Published 2026-03-19 · Updated 2026-03-20

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3

Description SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it was possible to create PDF templates containing <img> tags. When a PDF is exported using these templates, the content is rendered server-side, leading to a Server-Side Request Forgery (SSRF). Specifically, a crafted <img> tag, such as <img src=http://{burp collaborator url}>, causes the server to make a request to the specified URL.

Recommendations Update SuiteCRM to version 7.15.1 or later. Update SuiteCRM to version 8.9.3 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-29107

GHSA-G7CV-4GHJ-X98H

Affected Products

Suitecrm

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29107.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-g7cv-4ghj-x98h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29107 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29107 · Vendor Advisory
• https://docs.suitecrm.com/admin/releases/7.15.x · Note
• https://twitter.com/CVEnew/status/2034841506113355794 · Twitter Post