{"id":"CVE-2026-71550","published":"2026-11-05T19:17:26.357","lastModified":"2026-11-05T19:17:26.490","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow begins at modules/AOW_WorkFlow/controller.php and uses aow_action, and require_once() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with the WorkFlow role can include executable PHP, obtain server-side code execution, access CRM data and configuration secrets, and establish persistent access. This issue is fixed in versions 7.15.2 and 8.10.2.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-cx24-rr7r-mxrg","tags":[]}],"exploitRefs":[{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-cx24-rr7r-mxrg","tags":[]}],"hasPoc":true,"ai":{"summary":"A path traversal vulnerability in SuiteCRM's workflow controller allows authenticated users with the WorkFlow role to inject arbitrary PHP code via the aow_action parameter into require_once(), leading to remote code execution and full system compromise.","exploitability":"Exploitation requires low skill and only an authenticated session with the WorkFlow role; no additional privileges or user interaction are needed.","blast_radius":"Successful exploitation grants attackers full access to CRM data, configuration secrets, and persistent server-side code execution, enabling lateral movement and data exfiltration.","remediation":"Upgrade to SuiteCRM version 7.15.2 or 8.10.2 immediately; if upgrading is delayed, restrict access to the workflow controller endpoint (modules/AOW_WorkFlow/controller.php) to users without the WorkFlow role.","detection":"Monitor for require_once() calls in PHP logs referencing unexpected or non-standard paths under modules/AOW_WorkFlow/ with aow_action containing '..' sequences or absolute paths; also watch for POST requests to controller.php with unusually long or encoded aow_action values.","tags":["rce","path-traversal","php","webapp","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:43:58.198Z"}}