# CVE-2026-100358

Authenticated admin can inject persistent PHP leading to RCE in SuiteCRM.

- Page: https://www.vulneraibility.com/cve/CVE-2026-100358
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-94
- Also known as: GHSA-4773-c8fh-3rww
- Published: 2026-11-05

## Affected versions

- SuiteCRM: affected < 7.15.2; >= 8.0.0 and < 8.10.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated admin can inject PHP into language files producing persistent RCE as web-server user, enabling full app and host compromise.

## Action

Immediate action required

## Recommendation

Upgrade to 7.15.2 or 8.10.2 immediately; restrict admin access and audit custom language files.

## References

- [other] https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-4773-c8fh-3rww
- [other] https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
- [other] https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
- [other] https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
- [other] https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.