CVE-2026-29098
- Source
- https://cve.org/CVERecord?id=CVE-2026-29098
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29098.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-29098
- Aliases
-
- GHSA-6858-fhw5-56gf
- Published
- 2026-03-19T22:43:58.568Z
- Modified
- 2026-04-10T05:41:30.741850Z
- Severity
-
- 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action
- Details
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the
action_exportCustomfunction inmodules/ModuleBuilder/controller.phpfails to properly neutralize path traversal sequences in the$modulesand$nameparameters. Both parameters later reach theexportCustomfunction inmodules/ModuleBuilder/MB/MBPackage.phpwhere they are both utilized in constructing s paths for file reading and writing. As such, it is possible for a user with access to the ModuleBuilder module, generally an administrator, to craft a request that can copy the content of any readable directory on the underlying host into the web root, making them readable. As theModuleBuildermodule is part of both major versions 7 and 8, both current major versions are affected. This vulnerability allows an attacker to copy any readable directory into the web root. This includes system files like the content of `/etc, or the root directory of the web server, potentially exposing secrets and environment variables. Versions 7.15.1 and 8.9.3 patch the issue. - Database specific
{ "cwe_ids": [ "CWE-23" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29098.json", "cna_assigner": "GitHub_M" }- References