CVE-2026-29098 SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to versions 7.15.1 and 8.9.3, the actionexportCustom function in modules/ModuleBuilder/controller.php fails to properly neutralize path traversal sequences in the $modules and $name...

CVE-2026-29098

The CVE-2026-29098 issue affects SuiteCRM (open-source CRM) in both major branches 7 and 8. The root cause is improper neutralization of path traversal sequences in action_exportCustom (modules/ModuleBuilder/controller.php) parameters $modules and $name, which flow to exportCustom (modules/Module...

PT-2026-26436

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to versions 7.15.1 and 8.9.3, the action exportCustom function in modules/ModuleBuilder/controller.php fails to properly neutralize path traversal sequences in the $modules and $name...