A directory traversal weakness in SuiteCRM modules allows an attacker to send crafted requests that can potentially overload the application, leading to a denial of service. The vulnerability is a classic path traversal issue (CWE-23) and can disrupt normal operation by exhausting resources or triggering application errors.

All installations of SuiteCRM prior to version 7.15.1 and prior to version 8.9.3 are vulnerable. This includes the 7.x and 8.x major releases that have not been updated to the referenced patch levels. Users running the older releases should verify the major version and apply the corresponding fix.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploits. Attackers would need to execute crafted web requests against the vulnerable modules; remote exploitation is inferred from the nature of the issue, though no confirmed public exploit exists. Overall, the risk is modest, but proactive remediation is recommended to avoid potential service disruption.