CVE-2026-29098
Path Traversal in SuiteCRM ModuleBuilder Allows Arbitrary File Exposure
Publication date: 2026-03-19
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| suitecrm | suitecrm | to 7.15.1 (exc) |
| suitecrm | suitecrm | From 8.0.0 (inc) to 8.9.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-23 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in SuiteCRM versions prior to 7.15.1 and 8.9.3 in the ModuleBuilder module. The function action_exportCustom does not properly neutralize path traversal sequences in the parameters $modules and $name. These parameters are then used to construct file paths for reading and writing in the exportCustom function. As a result, a user with access to the ModuleBuilder module, typically an administrator, can craft a request that copies the contents of any readable directory on the host system into the web root, making those files accessible via the web.
This means an attacker can potentially expose sensitive system files such as those in /etc or the root directory of the web server, including secrets and environment variables.
How can this vulnerability impact me? :
The vulnerability allows an attacker with ModuleBuilder access to copy any readable directory from the server into the web root, exposing sensitive files to unauthorized users.
- Exposure of system files such as configuration files, environment variables, and secrets.
- Potential leakage of sensitive information that could be used for further attacks.
- Compromise of confidentiality due to unauthorized file disclosure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade SuiteCRM to version 7.15.1 or later if you are using the 7.x branch, or to version 8.9.3 or later if you are using the 8.x branch.
Restrict access to the ModuleBuilder module to only trusted administrators, as exploitation requires access to this module.