PT-2026-26447 · Suitecrm · Suitecrm-Core

Rvizx · Published 2026-03-19 · Updated 2026-03-20 · CVE-2026-29109

Mitre

CVSS v4.0

8.6

High

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component that allows an authenticated administrator to execute arbitrary system commands on the server. FilterDefinitionProvider.php calls unserialize() on user-controlled data from the saved search.contents database column without restricting instantiable classes. Version 8.9.3 patches the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-29109

Affected Products

Suitecrm-Core

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-29109 · Security Note
• https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-mhq2-277m-6w24 · Note