Dashboard / CVE-2026-63213

CVE-2026-63213

HIGH
MEDIUM Priority: 0.04 BB Relevance: 60/100
Published: 2026-11-05 Modified: 2026-11-10 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: High
I: High
A: High

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does not reject traversal sequences. An authenticated administrator can copy extracted package files outside the intended destination, overwrite application or configuration files, place executable PHP under the web root, or cause denial of service. This issue is fixed in versions 7.15.2 and 8.10.2.

Weakness Classification (1)

Affected Software (5)

VendorProductVersion
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2
suitecrm suitecrm < 7.15.2

References & Advisories (5)

Bug Bounty Relevance

60 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.55%
Raw Score 0.005520
Percentile 46.7%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00552
2026-11-13
0.00552
2026-11-12
0.00552
2026-11-10
0.00552
2026-11-09
0.00552
2026-11-08
0.00552
2026-11-07
0.00552
2026-11-06
0.00552

Intelligence Sources

mitre ref →
nvd ref →

External Links