CVE-2025-54785: SuiteCRM is Vulnerable to PHP Object Injection in Reports
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54785?
CVE-2025-54785 has a medium severity rating due to the potential for privilege escalation via unserialization vulnerabilities.
How do I fix CVE-2025-54785?
To fix CVE-2025-54785, upgrade SuiteCRM to version 7.14.7 or higher.
Which versions of SuiteCRM are affected by CVE-2025-54785?
CVE-2025-54785 affects SuiteCRM versions 7.14.6 and 8.8.0.
What type of vulnerability is CVE-2025-54785?
CVE-2025-54785 is an unserialize vulnerability that involves inadequate input validation.
Can CVE-2025-54785 lead to data breaches?
Yes, CVE-2025-54785 could potentially lead to unauthorized access and data breaches if exploited.