CVE-2026-63213

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden ziptodir parameter, while cleanpath does not reject traversal sequences. An authenticated administrator can copy...

CVE-2026-63213 SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden ziptodir parameter, while cleanpath does not reject traversal sequences. An authenticated administrator can copy...

CVE-2026-63213

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to a path traversal flaw in the Upgrade Wizard commit flow . The vulnerability stems from the application trusting the hidden zip_to_dir parameter while the clean_path() function fails to reject traversal sequences. An authenticated admi...

EUVD-2026-117654

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden ziptodir parameter, while cleanpath does not reject traversal sequences. An authenticated administrator can copy...

Citrix Provisioning - Farm Is Already Configured Option Missing From Wizard After Upgrade

After running the PVS installer for 2311 or greater the configuration wizard runs as expected. When running the wizard the console user is only presented with 2 options when configuring the database parameters: 1. Join Existing 2.Create Farm The Farm is already configured option is no longer...

CVE-2021-41597

SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive...

PT-2019-15080 · Sugarcrm · Sugarcrm

Name of the Vulnerable Software and Affected Versions: SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description: The issue allows PHP object injection in the UpgradeWizard module by an Admin user. Recommendations: For SugarCRM versions prior to 8.0.4, update to version...