A path‑traversal weakness exists in the export custom functionality of SuiteCRM’s ModuleBuilder component. When a user supplies specially crafted names for the module and file parameters, the application constructs file paths without proper sanitization and copies the contents of any readable directory on the server into the web root. This allows an attacker who can reach the ModuleBuilder interface, typically an administrator, to expose sensitive files such as configuration data, environment variables, or even system files in /etc, by making them publicly accessible through the web application.

Versions of SuiteCRM prior to 7.15.1 and 8.9.3 contain the vulnerability. Both the 7.x and 8.x branches have the export custom feature, so all releases up to 7.15.0 and 8.9.2 are affected. The issue was fixed in release 7.15.1 and 8.9.3, which patch the path‑traversal logic in the controller and export code.

The CVSS score of 4.9 signals moderate severity, and the EPSS probability below 1 % indicates rare exploitation. The flaw requires authenticated access to the SuiteCRM instance with permission to use ModuleBuilder; no additional network privileges are needed. Once an administrator can craft the export request, the attacker can place copies of any accessible directory into the publicly reachable web root, enabling information disclosure. Because the attack path is bounded to an existing feature, the vulnerability can be exploited easily by anyone with admin rights to the application.