CVE-2026-29109: SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component that allows an authenticated administrator to execute arbitrary system commands on the server. FilterDefinitionProvider.php calls unserialize() on user-controlled data from the savedsearch.contents database column without restricting instantiable classes. Version 8.9.3 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29109?
CVE-2026-29109 is classified as a critical vulnerability due to its potential for authenticated remote code execution.
How do I fix CVE-2026-29109?
To fix CVE-2026-29109, update SuiteCRM to version 8.9.3 or later where the vulnerability has been addressed.
What versions of SuiteCRM are affected by CVE-2026-29109?
CVE-2026-29109 affects SuiteCRM versions up to and including 8.9.2.
What type of vulnerability is CVE-2026-29109?
CVE-2026-29109 is an unsafe deserialization vulnerability that allows for remote code execution.
Can CVE-2026-29109 be exploited without authentication?
No, CVE-2026-29109 requires authenticated access to exploit the vulnerability.