SuiteCRM versions prior to 7.15.1 and 8.9.3 allow an authenticated administrator in the Configurator module to bypass file type restrictions when uploading PDF font files, enabling the upload of arbitrary files with attacker‑controlled filenames to the server. This flaw constitutes an arbitrary file upload vulnerability (CWE‑434) that compromises data integrity and may assist in further attacks if the upload directory is accessed or misconfigured. The vulnerability does not provide immediate remote code execution but can undermine security boundaries and facilitate more serious exploits when combined with other weaknesses.

The affected product is SuiteCRM, specifically installations running any version older than 7.15.1 or 8.9.3. The vendor responsible is SuiteCRM. No additional affected vendors or versions are listed.

The CVSS score of 2.7 indicates a low severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. It is not cataloged as a Known Exploited Vulnerability by CISA. Exploitation requires valid administrative credentials, as the attack vector is an authenticated administrator. While the upload path is not directly web‑accessible by default, the ability to write files to the server still breaks intended security boundaries and can support further attacks in certain deployment configurations.