CVE-2026-71550

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description The workflow controller in this Customer Relationship Management application contains a path traversal flaw. The issue occurs in the modules/AOW WorkFlow/controller.php file, where the require once() function processes the aow action variable without proper constraint of the resolved file. An authenticated user with the WorkFlow role can exploit this to include executable PHP code, leading to server-side code execution, unauthorized access to CRM data and configuration secrets, and the establishment of persistent access.

Recommendations Update to version 7.15.2 or later. Update to version 8.10.2 or later.