CVE-2026-29104

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an authenticated arbitrary file upload vulnerability in the Configurator module. An authenticated administrator can bypass intended file type restrictions when uploading PDF font files, allowing arbitrary files with attacker‑controlled filenames to be written to the server. Although the upload directory is not directly web‑accessible by default, this behavior breaks security boundaries and may enable further attacks when combined with other vulnerabilities or in certain deployment configurations. Versions 7.15.1 and 8.9.3 patch the issue.

• CWE-434

• https://docs.suitecrm.com/admin/releases/7.15.xRelease Notes
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-5hx9-cmmx-26p3Vendor Advisory

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29099SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-2910A flaw has been found in Tenda HG9 300001138. This vulnerabi…8.8
• CVE-2026-29100SuiteCRM is an open-source, enterprise-ready Customer Relati…6.1
• CVE-2026-29101SuiteCRM is an open-source, enterprise-ready Customer Relati…7.5
• CVE-2026-29102SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-29103SuiteCRM is an open-source, enterprise-ready Customer Relati…7.2
• CVE-2026-29105SuiteCRM is an open-source, enterprise-ready Customer Relati…6.1
• CVE-2026-29106SuiteCRM is an open-source, enterprise-ready Customer Relati…6.1
• CVE-2026-29107SuiteCRM is an open-source, enterprise-ready Customer Relati…5.3
• CVE-2026-29108SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2026-29109SuiteCRM is an open-source, enterprise-ready Customer Relati…7.2
• CVE-2026-2911A vulnerability has been found in Tenda FH451 up to 1.0.0.9.…8.8