CVE-2026-63213

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The Upgrade Wizard commit flow trusts the hidden zip to dir parameter, and the clean path() function fails to reject traversal sequences. This allows an authenticated administrator to copy extracted package files outside the intended destination, overwrite application or configuration files, place executable PHP files under the web root, or cause a denial of service.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.