{"id":"CVE-2026-63213","summary":"SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM","details":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does not reject traversal sequences. An authenticated administrator can copy extracted package files outside the intended destination, overwrite application or configuration files, place executable PHP under the web root, or cause denial of service. This issue is fixed in versions 7.15.2 and 8.10.2.","aliases":["GHSA-wfvr-mpq2-257w"],"modified":"2026-11-05T21:32:25.654031577Z","published":"2026-11-05T18:17:00.073Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63213.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63213.json"},{"type":"FIX","url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68"},{"type":"WEB","url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2"},{"type":"FIX","url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c"},{"type":"WEB","url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2"},{"type":"ADVISORY","url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-wfvr-mpq2-257w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63213"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/suitecrm/suitecrm","events":[{"introduced":"0"},{"fixed":"d6bca97a0159ec019a969b86eca32affab3beb7c"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"7.15.2"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"d6bca97a0159ec019a969b86eca32affab3beb7c"}]},{"source":"REFERENCES_TAG","original_tag":"v7.15.2","range":[{"fixed":"d6bca97a0159ec019a969b86eca32affab3beb7c"}]}]}}],"versions":["v7.15.1","v7.14.8","v7.15.0","v7.14.7","v7.14.6","v7.14.5","v7.14.4","v7.14.3","v7.14.2","v7.14.1","v7.14.0","v7.14.0-beta","v7.13.4","v7.13.3","v7.13.2","v7.13.1","v7.13.0","v7.12.8","v7.13.0-beta","v7.12.7","v7.12.6","v7.12.5","v7.12.4","v7.12.3","v7.12.2","v7.12.1","v7.12.0","v7.12-rc","v7.11.18","v7.11.17","v7.11.16","v7.11.15","v7.11.14","v7.11.13","v7.11.12","v7.11.11","v7.11.8","v7.11.7","v7.11.6","v7.11.5","v7.11.4","v7.11.3","v7.11.2","v7.10.12","v7.11.1","v7.11.0","v7.10.11","v7.10.10","v7.10.5","v7.10.7","v7.10.4","v7.10.6","v7.10.1","v7.10.3","v7.10.2","v7.10.0","v7.9.14","v7.9.13","v7.9.12","v7.9.11","v.7.9.11","v7.9.10","v7.9.8","v7.9.4","7.9.6","v7.9.5","v7.9.3","v7.9.1","v7.9.0","v7.9.0-rc","v7.9.0-beta","v7.8.2","v7.8.1","v7.8.0","v7.8.0-rc","v7.8.0-beta.2","v7.8.0-beta","v7.7.4","v7.7.3","v7.7.2","v7.7","v7.7-rc2","v7.7-rc","v7.7-beta2","v7.7-beta1","v7.6.1","v7.6","v7.5.1","v7.5-beta.2","v7.4.3","v7.5-beta","v7.4.1","v7.4.2","v7.3.2","v7.3.1","v7.3","v7.3-beta","v7.2","v7.2.1","v7.1.3","v7.2beta2","v7.1.4","v7.2beta","v7.1.2","v7.1.1","v7.1","v7.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63213.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/suitecrm/suitecrm-core","events":[{"introduced":"55c1ee9cbdf409ed41c04da0bbf442b311a3ab57"},{"fixed":"6c7ce002a8f9b594eb80021d273af0aee72af54a"},{"fixed":"a11f50180d939f639cc468b5d536e8ad714dfb68"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"8.0.0"},{"fixed":"8.10.2"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"a11f50180d939f639cc468b5d536e8ad714dfb68"}]},{"original_tag":"v8.10.2","range":[{"fixed":"6c7ce002a8f9b594eb80021d273af0aee72af54a"}],"source":"REFERENCES_TAG"}]}}],"versions":["v8.10.1","v8.10.0","v8.9.3","v8.9.2","v8.9.1","v8.9.0","v8.8.1","v8.8.0","v8.8.0-beta","v8.7.1","v8.7.0","v8.7.0-beta","v8.6.2","v8.6.1","v8.6.0","v8.5.1","v8.5.0","v8.4.2","v8.4.1","v8.4.0","v8.4.0-beta","v8.3.1","v8.3.0","v8.2.4","v8.2.3","v8.2.2","v8.2.1","v8.2.0","v8.2.0-beta.2","v8.1.3","v8.1.2","v8.1.1","v8.1.0","v8.0.4","v8.0.3","v8.0.2","v8.0.1","v8.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63213.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}