CVE-2026-29096
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
Published Mar 19, 2026 · updated Jun 17, 2026 · suitecrm suitecrm
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or editing a report (AOR_Reports module), the parameter from POST data is saved directly into the table without any validation. Later, when the report is executed/viewed, this value is concatenated directly into a SQL SELECT query without sanitization, enabling second-order SQL injection. Any authenticated user with Reports access can extract arbitrary database contents (password hashes, API tokens, config values). On MySQL with FILE privilege, this could lead to RCE via SELECT INTO OUTFILE. Versions 7.15.1 and 8.9.3 patch the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 19, 2026 · NIST NVD
Detected
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or editing a report (AOR_Reports module), the parameter from POST data is saved directly into the table without any validation. Later, when the report is executed/viewed, this value is concatenated directly into a SQL SELECT query without sanit
Jun 17, 2026 · NIST NVD
Updated
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or editing a report (AOR_Reports module), the parameter from POST data is saved directly into the table without any validation. Later, when the report is executed/viewed, this value is concatenated directly into a SQL SELECT query without sanit
Affected
- cpe suitecrm/suitecrmversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-29096
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-29096
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or editing a report (AOR_Reports module), the parameter from POST data is saved directly into the `aor_fiel
nvd.nist.gov