CVE-2026-71550

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aowaction value in requireonce without constraining the resolved file. The affected flow begins at...

CVE-2026-71550

The SuiteCRM CRM application is vulnerable to Local File Inclusion (LFI) leading to Remote Code Execution (RCE) in versions prior to 7.15.2 and 8.10.2 . The root cause is located in the workflow controller (modules/AOW_WorkFlow/controller.php), where the aow_action value is passed to require_once...