CVE-2026-71550

Summary

A path traversal vulnerability in SuiteCRM's workflow controller allows authenticated users with the WorkFlow role to inject arbitrary PHP code via the aow_action parameter into require_once(), leading to remote code execution and full system compromise.

Exploitability

Exploitation requires low skill and only an authenticated session with the WorkFlow role; no additional privileges or user interaction are needed.

Blast radius

Successful exploitation grants attackers full access to CRM data, configuration secrets, and persistent server-side code execution, enabling lateral movement and data exfiltration.

Detection

Monitor for require_once() calls in PHP logs referencing unexpected or non-standard paths under modules/AOW_WorkFlow/ with aow_action containing '..' sequences or absolute paths; also watch for POST requests to controller.php with unusually long or encoded aow_action values.

Prioritized remediation

Upgrade to SuiteCRM version 7.15.2 or 8.10.2 immediately; if upgrading is delayed, restrict access to the workflow controller endpoint (modules/AOW_WorkFlow/controller.php) to users without the WorkFlow role.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.