SuiteCRM up to 7.15.0/8.9.2 ModuleBuilder controller.php action_exportCustom modules/name path traversal

Summaryinfo

A vulnerability classified as problematic was found in SuiteCRM up to 7.15.0/8.9.2. This vulnerability affects the function action_exportCustom of the file modules/ModuleBuilder/controller.php of the component ModuleBuilder Module. Executing a manipulation of the argument modules/name can lead to path traversal. The identification of this vulnerability is CVE-2026-29098. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in SuiteCRM up to 7.15.0/8.9.2 and classified as problematic. This vulnerability affects the function action_exportCustom of the file modules/ModuleBuilder/controller.php of the component ModuleBuilder Module. The manipulation of the argument modules/name with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-23. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality. CVE summarizes:

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `action_exportCustom` function in `modules/ModuleBuilder/controller.php` fails to properly neutralize path traversal sequences in the `$modules` and `$name` parameters. Both parameters later reach the `exportCustom` function in `modules/ModuleBuilder/MB/MBPackage.php` where they are both utilized in constructing s paths for file reading and writing. As such, it is possible for a user with access to the ModuleBuilder module, generally an administrator, to craft a request that can copy the content of any readable directory on the underlying host into the web root, making them readable. As the `ModuleBuilder` module is part of both major versions 7 and 8, both current major versions are affected. This vulnerability allows an attacker to copy any readable directory into the web root. This includes system files like the content of `/etc, or the root directory of the web server, potentially exposing secrets and environment variables. Versions 7.15.1 and 8.9.3 patch the issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-29098 since 03/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

By approaching the search of inurl:modules/ModuleBuilder/controller.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 7.15.1 or 8.9.3 eliminates this vulnerability. The upgrade is hosted for download at docs.suitecrm.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• SuiteCRM

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.12
• 7.13
• 7.14
• 7.15.0
• 8.9.0
• 8.9.1
• 8.9.2

License

• open-source

Website

• Product: https://github.com/SuiteCRM/SuiteCRM/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion