CVE-2026-100358

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The Studio Dropdown Editor improperly handles the dropdown name variable by passing it through the html entity decode() function and writing the result directly into a PHP language file within the custom directory. This allows an administrator to inject persistent PHP code that executes with the privileges of the web-server account. This action can compromise the confidentiality, integrity, and availability of both the application and the host system, and the injected code persists even after cache clears.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.