CVE-2026-29103

The error lies in the ModuleScanner.php file, responsible for analyzing PHP tokens within the MLP security mechanism. The scanner incorrectly resets the internal state of the $checkFunction flag after encountering any single token (e.g., =, . or ;). An attacker can exploit this flaw by hiding calls to dangerous functions (e.g., system(), exec()) inside variable assignments or string concatenation. As a result, MLP security controls are completely bypassed, and malicious code passes validation without detection.

An authenticated administrator can execute arbitrary system commands on the server, which in practice means complete system takeover, data exfiltration, and potential for further lateral movement in the network.

SuiteCRM should be updated to version 7.15.1 or 8.9.3, which contain fixes for the described vulnerability. Details are available in the vendor's official release notes and GitHub security advisory.

SuiteCRM versions 7.15.0 and 8.9.2