{"id":"CVE-2026-71550","aliases":[],"cve":{"records":[{"id":"CVE-2026-71550","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-06T21:24:15.375Z","published":"2026-11-05T18:36:47.423Z","modified":"2026-11-05T18:36:47.423Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-11-05T18:36:47.423Z"}],"references":[{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-cx24-rr7r-mxrg","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-98","description":"CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"SuiteCRM: LFI to RCE via AOW_WorkFlow","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow begins at modules/AOW_WorkFlow/controller.php and uses aow_action, and require_once() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with the WorkFlow role can include executable PHP, obtain server-side code execution, access CRM data and configuration secrets, and establish persistent access. This issue is fixed in versions 7.15.2 and 8.10.2.","score":9.9,"severity":"critical","published":"2026-11-05T18:36:47.423Z","modified":"2026-11-05T18:36:47.423Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"SuiteCRM","name":"SuiteCRM","platforms":[],"versions":[{"version":"< 7.15.2","status":"affected"},{"version":">= 8.0.0, < 8.10.2","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-71550"}],"remediation":[],"references":["https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-cx24-rr7r-mxrg","https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2"],"sources":[{"name":"CVE","id":"CVE-2026-71550","modified":"2026-11-05T18:36:47.423Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-71550"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9}],"sourceAffected":[],"observedAt":"2026-11-05T19:04:55.648Z","kev":{"status":"not-listed","checkedAt":"2026-11-07T23:00:33.112Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T19:20:41.112Z","attemptedAt":"2026-11-05T19:20:41.112Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-05T19:20:38.780Z","attemptedAt":"2026-11-05T19:20:38.780Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-05T19:20:40.723Z","attemptedAt":"2026-11-05T19:20:40.723Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T19:20:40.595Z","attemptedAt":"2026-11-05T19:20:40.595Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-71550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71550","modified":"2026-11-05T19:17:26.490","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-11-05T19:20:41.112Z"}],"aiSummary":{"text":"SuiteCRM versions prior to 7.15.2 and 8.10.2 have a vulnerability that allows an authenticated user with the WorkFlow role to include executable PHP, potentially accessing CRM data and configuration secrets. The weakness is due to improper control of filenames in PHP include/require statements. An attacker must have WorkFlow role access to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T19:06:15.377Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-71550"}]}}