SuiteCRM is an open-source CRM platform. Before versions 7.15.2 and 8.10.2, the Studio Dropdown Editor accepted a dropdown name, decoded it, and wrote the result directly into a PHP file in the custom directory. An administrator can supply arbitrary PHP code via the dropdown field, which is then executed by the web server every time the file is included. This allows the attacker to persistently run code as the web‑server user, leading to full compromise of application confidentiality, integrity, availability, and potentially the underlying host. The vulnerability is an example of code injection (CWE‑94).

The affected product is SuiteCRM SuiteCRM. Systems running versions earlier than 7.15.2 or 8.10.2 are vulnerable. The module containing the flaw is the Studio Dropdown Editor, which is normally accessible only to administrators.

The CVSS score of 9.4 indicates high severity. While the EPSS score is not available, the lack of a publicly listed KEV suggests a lower likelihood of widespread exploitation, though the flaw remains attractive to attackers with admin access. The attack vector is likely an authenticated administrator using the web interface, as the flaw requires sending a crafted dropdown name. Once the malicious file is created, it persists across cache clears, making the vulnerability highly exploitable if the attacker can gain administrative access.