External risk intelligence

SuiteCRM Studio Dropdown Editor Code Injection

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-100358

SuiteCRM is a web-based Customer Relationship Management application typically deployed as an internet-facing or internal-facing web application. Because it is a business web application commonly accessed over HTTP/HTTPS to serve users, it falls under the category of web-based software where internet or intranet exposure is the standard deployment pattern.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in SuiteCRM's Studio Dropdown Editor could allow an administrator to inject persistent PHP code. This code could execute with the privileges of the web server, potentially compromising the confidentiality, integrity, and availability of the application and its host. This issue affects versions prior to 7.15.2 and 8.10.2.

Allows administrator code injection.
Matters for application control and data protection.
Confirm if your SuiteCRM is affected and potentially exposed.

Attack Path

How an attacker could exploit the issue

An attacker with administrative privileges in SuiteCRM can leverage the Studio Dropdown Editor to inject persistent PHP code. This code, after being processed by `html_entity_decode()` and saved into a custom PHP file, will execute as the web server's user on subsequent page loads, even after cache clearing. This allows for a compromise of the application and host's confidentiality, integrity, and availability.

Requires administrator access.
Injecting code via Studio Dropdown Editor.
Full application and host compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an administrator to inject persistent PHP code into the application's custom directory. When the affected application loads these custom files, the injected PHP code would execute with the privileges of the web server. This could compromise the confidentiality, integrity, and availability of the application and the host system.

Application and host confidentiality at risk.
Code execution via administrator action.
Compromise of application and host.

Operational Fix

Recommended remediation, mitigation, and detection steps

SuiteCRM administrators are responsible for managing the application's deployment and ensuring its security. The initial focus should be on identifying all instances of SuiteCRM within the environment, determining their business criticality and network exposure, and then locating the designated owner of each instance to coordinate remediation efforts.

Identify and inventory all SuiteCRM instances.
Confirm business criticality and network reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SuiteCRM?

SuiteCRM is a widely used, open-source Customer Relationship Management (CRM) application designed to help businesses manage sales, marketing, and customer support data. It operates as a web-based software platform, meaning it is installed on a server and accessed by employees through their web browsers to track interactions and organize business workflows.

What is the vulnerability in CVE-2026-100358?

This vulnerability is classified as Improper Control of Generation of Code, or CWE-94. It occurs because the Studio Dropdown Editor component handles input insecurely before saving it to a file. Essentially, the software takes data intended to be simple text and accidentally allows it to be processed as executable PHP code, which the server then runs.

How does an attacker trigger this code injection?

To trigger the bug, an attacker must already possess administrative privileges within the SuiteCRM application. They use the Studio Dropdown Editor to inject malicious PHP code, which is then saved into a custom language file. The code executes whenever the application loads that file. Normal users without administrative access cannot trigger this vulnerability.

Is my SuiteCRM instance at risk?

According to Halo Surface Signal, SuiteCRM is typically deployed as a web application accessible via HTTP/HTTPS, making it a common target. If your instance is internet-facing or widely accessible on an internal network, it is a higher priority. You should check your current version against the affected releases to determine if you need to act.

How do I fix CVE-2026-100358?

The primary response is to update your SuiteCRM installation. The vulnerability is resolved in versions 7.15.2 and 8.10.2. Begin by taking an inventory of all SuiteCRM instances in your environment, verifying their current versions, and coordinating with the application owners to apply the necessary patches to move to a secure version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.