CVE-2026-100358: SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdownname through htmlentitydecode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account, survives cache clears, and compromises application and host confidentiality, integrity, and availability. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SuiteCRM administrator who can use the Studio Dropdown Editor can inject PHP through a dropdown name. The injected code runs as the web-server account when the generated language file is included on later page loads.
Which SuiteCRM versions are affected?
SuiteCRM versions before 7.15.2 and before 8.10.2 are affected. The issue is fixed in 7.15.2 and 8.10.2.
Does clearing the application cache remove a malicious payload?
No. The injected PHP is written to a file under custom/ and survives cache clears.
How can I check for potential compromise?
Review PHP language files under the custom/ directory, particularly files generated through the Studio Dropdown Editor, for unexpected or executable PHP content. Also investigate recent administrative use of the Dropdown Editor.