SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41596.json"