SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID (e.g. attachments). An unauthenticated attacker could download internal files when he discovers a valid file-ID.
Valid IDs could be brute-forced, but this is quite time-consuming as the file-IDs are usually UUIDs. This issue is fixed in version 7.14.7.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7 | Release Notes |
| https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-8r72-224q-g9fv | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Aug 2025, 20:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:* cpe:2.3:a:salesagility:suitecrm:7.14.6:*:*:*:*:*:*:* |
|
| First Time |
Salesagility
Salesagility suitecrm |
|
| References | () https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7 - Release Notes | |
| References | () https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-8r72-224q-g9fv - Vendor Advisory |
07 Aug 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-07 22:15
Updated : 2025-08-12 20:54
NVD link : CVE-2025-54787
Mitre link : CVE-2025-54787
JSON object : View
Products Affected
salesagility
- suitecrm
CWE
CWE-285
Improper Authorization