# CVE-2026-63213: SuiteCRM Upgrade Wizard path traversal in zip extraction

Source: https://junglewise.ai/threats/cve-2026-63213-suitecrm-is-an-open-source-enterprise-ready-customer-relationship  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-63213 · Severity: high · CVSS 7.2 · Published 2026-11-05

SuiteCRM is an open-source CRM system used to manage customer relationships and sales pipelines. An authenticated administrator can exploit a path traversal flaw in the Upgrade Wizard to extract malicious files outside the intended directory, potentially overwriting critical application files, installing web-accessible PHP backdoors, or disrupting service availability.

Technologies: [SuiteCRM](https://junglewise.ai/threats/technologies/suitecrm-suitecrm). Vendors: [SuiteCRM](https://junglewise.ai/threats/vendors/suitecrm).

## Quick answers

**Is CVE-2026-63213 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63213 being exploited in the wild.

**How severe is CVE-2026-63213?** High severity, with a CVSS score of 7.2, published 5 November 2026.

**Which products and versions are affected?** SuiteCRM prior to 7.15.2 and 8.10.2.

**Is there a fix for CVE-2026-63213?** Yes: fixed in 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63213 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-63213?** Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.15.2, 8.10.2

## Technical details

The Upgrade Wizard's commit flow trusts an unsanitized hidden zip_to_dir parameter without proper validation; the clean_path() function fails to reject directory traversal sequences (e.g., ../). An authenticated administrator can craft a malicious package archive to extract files outside the destination directory, enabling file overwrite, arbitrary PHP execution in the web root, or denial of service.

## Affected products

- SuiteCRM SuiteCRM prior to 7.15.2 and 8.10.2

## Timeline

- 2026-11-05: published
- 2026-07-29: patched: Fix commit date from GitHub repository

## References

- [https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68](https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68)
- [https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2](https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2)

## Related threats

- [SuiteCRM SQL injection in SOAP portal API](https://junglewise.ai/threats/cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM path traversal in workflow controller](https://junglewise.ai/threats/cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in report query builder](https://junglewise.ai/threats/cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM SQL injection in AOR report generation](https://junglewise.ai/threats/cve-2026-69145-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)
- [SuiteCRM download authorization bypass in document access](https://junglewise.ai/threats/cve-2026-69144-suitecrm-is-an-open-source-enterprise-ready-customer-relationship)