CVE-2026-29101: SuiteCRM Vulnerable to Directory Traversal to DoS in Modules
Published Mar 19, 2026
·Updated
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a Denial-of-Service (DoS) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue.
Affected Software
3 affected components
SuiteCRM SuiteCRM<7.15.1, <8.9.3
SuiteCRM SuiteCRM<7.15.1
SuiteCRM SuiteCRM>=8.0.0<8.9.3
Event History
Mar 19, 2026
CVE Published
via MITRE·10:51 PM
Data Sourced
via MITRE·10:51 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-29101?
The CVE-2026-29101 vulnerability is classified as a Denial-of-Service vulnerability.
2
How do I fix CVE-2026-29101?
To fix CVE-2026-29101, upgrade SuiteCRM to version 7.15.1 or later, or 8.9.3 or later.
3
Which versions of SuiteCRM are affected by CVE-2026-29101?
Versions prior to 7.15.1 and 8.9.3 of SuiteCRM are affected by CVE-2026-29101.
4
What type of attack does CVE-2026-29101 enable?
CVE-2026-29101 enables a directory traversal attack that can lead to a Denial-of-Service condition.
5
Is SuiteCRM the only software affected by CVE-2026-29101?
Yes, CVE-2026-29101 specifically affects the SuiteCRM software.