CVE-2026-29107

Summary

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it is possible to create PDF templates with <img> tags. When a PDF is exported using this template, the content (for example, <img src=http://{burp_collaborator_url}> is rendered server side, and thus a request is issued from the server, resulting in Server-Side Request Forgery. Versions 7.15.1 and 8.9.3 patch the issue.

Affected Software

VendorProductVersion RangeStatus
SuiteCRMSuiteCRM< 7.15.1affected
SuiteCRMSuiteCRM>= 8.0.0, < 8.9.3affected

Weaknesses

  • CWE-918: CWE-918: Server-Side Request Forgery (SSRF)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References