CVE-2026-29109
🟡 Monitoruj
Niebezpieczna deserializacja w SuiteCRM umożliwia uwierzytelnionemu administratorowi wykonanie dowolnych poleceń systemowych na serwerze.
CVSS
7.2
EPSS
0.1%
Exploit
none
Vendor
suitecrm
Opis źródłowy (NVD)
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component that allows an authenticated administrator to execute arbitrary system commands on the server. `FilterDefinitionProvider.php` calls `unserialize()` on user-controlled data from the `saved_search.contents` database column without restricting instantiable classes. Version 8.9.3 patches the issue.
deserialization
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.2 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.1% |
| Opublikowano (NVD) | 2026-03-20 00:16:16 UTC |
| Ostatnia modyfikacja (NVD) | 2026-03-23 16:48:58 UTC |
Referencje
- https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-mhq2-277m-6w24 (security-advisories@github.com) [Vendor Advisory]