CVE-2026-29107: SuiteCRM vulnerable to authenticated SSRF via PDF export
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it is possible to create PDF templates with <img> tags. When a PDF is exported using this template, the content (for example, <img src=http://{burpcollaboratorurl}> is rendered server side, and thus a request is issued from the server, resulting in Server-Side Request Forgery. Versions 7.15.1 and 8.9.3 patch the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29107?
CVE-2026-29107 is considered a moderate severity vulnerability due to its potential for authenticated server-side request forgery (SSRF).
How do I fix CVE-2026-29107?
To fix CVE-2026-29107, upgrade to SuiteCRM versions 7.15.1 or 8.9.3 or later, where this vulnerability is patched.
Who is affected by CVE-2026-29107?
CVE-2026-29107 affects SuiteCRM versions prior to 7.15.1 and 8.9.3.
What type of vulnerability is CVE-2026-29107?
CVE-2026-29107 is an authenticated server-side request forgery (SSRF) vulnerability affecting PDF templates in SuiteCRM.
Can CVE-2026-29107 be exploited remotely?
CVE-2026-29107 cannot be exploited remotely as it requires authentication to exploit the SSRF vulnerability.