Unrated severityNVD Advisory· Published Mar 19, 2026· Updated Mar 20, 2026
SuiteCRM vulnerable to authenticated SSRF via PDF export
CVE-2026-29107
Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it is possible to create PDF templates with <img> tags. When a PDF is exported using this template, the content (for example, <img src=http://{burp_collaborator_url}> is rendered server side, and thus a request is issued from the server, resulting in Server-Side Request Forgery. Versions 7.15.1 and 8.9.3 patch the issue.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- docs.suitecrm.com/admin/releases/7.15.xmitrex_refsource_MISC
- github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-g7cv-4ghj-x98hmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.