SuiteCRM Studio Dropdown Editor PHP injection allows admin remote code execution (CVE-2026-100358)

What happened

The vulnerability is in the Studio Dropdown Editor, an administrator-only customisation area. When a dropdown is created or edited, the supplied name is processed with html_entity_decode() and then written without further sanitisation into a PHP language file under custom/. That file is included when pages are loaded later, so the injected PHP runs in the context of the web-server account.

An attacker needs high-privileged access to SuiteCRM; no further user interaction is required once they hold administrator rights. Because the code is persisted in a PHP file rather than stored data, it survives cache clears and can affect the application and the underlying host. The CVSS v4.0 score is 9.4, or critical. The CVE record does not state that active exploitation has been observed.

Who is affected

SuiteCRM before 7.15.2, and SuiteCRM 8.0.0 through versions before 8.10.2, are affected. The vulnerable component is the Studio Dropdown Editor, which is an administrator-level customisation tool in the self-hosted CRM application.

What to do now

1. Confirm which SuiteCRM branch you run: anything before 7.15.2 on the 7.x branch, and 8.0.0 through versions before 8.10.2 on the 8.x branch.
2. Review the maintainers' advisory and the release notes for SuiteCRM 7.15.2 and 8.10.2. The CVE description identifies these as the versions in which the issue is fixed; no workaround is listed in the CVE record.
3. If your environment remains on an affected version, restrict access to Studio in general and the Dropdown Editor in particular, limit the number of administrator accounts, and monitor or compare files under custom/ for unexpected PHP after administrative changes.
4. If a fixed version cannot be applied quickly, treat the web-server account as potentially compromised after suspicious administrator activity and review host-level controls.

How to detect it

Review files under custom/ that are written by the Studio Dropdown Editor, and diff them against known-good copies after any administrator changes. Unexpected PHP opening or closing tags in language files, or changes to those files that coincide with administrator sessions, may indicate abuse. Monitor administrator activity around the Dropdown Editor, particularly creation or edit events performed by accounts with no normal customisation duties.

Beyond the patch

Admin-authenticated injection is easy to dismiss because the attacker already has high rights, but the persistence in a PHP file and execution as the web-server account make this a host compromise rather than a routine CRM misconfiguration. A penetration test or hardening review can find injection, deserialisation and authentication weaknesses such as this before they are exploited (Implementation & Assessment Services). Supply chain discipline is the other half: knowing where SuiteCRM is deployed and how quickly the maintainers ship fixes sets your real exposure window (Supply Chain Defense & Third-Party Risk).