SuiteCRM allows an authenticated attacker to create or export PDF templates that contain arbitrary <img> tags. When the server renders these PDFs, it fetches the image sources from the specified URLs, enabling the attacker to force the server to make requests to internal or external addresses. This Server‑Side Request Forgery can disclose sensitive information, interact with internal services, or serve as a pivot for further attacks. The weakness is classified as CWE‑918, and its impact can compromise confidentiality, integrity, or availability of data accessed by the exploited web server.

The vulnerability affects SuiteCRM versions prior to 7.15.1 and 8.9.3. Specifically, any deployment running SuiteCRM 7.15.0 or earlier, or 8.9.2 or earlier, is susceptible. Versions 7.15.1 and above, as well as 8.9.3 and above, contain the patch that disables the vulnerable behavior.

The CVSS score of 5 indicates a medium severity. The EPSS score is below 1 %, suggesting the exploitation rate is currently low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need valid user credentials and the ability to create or export PDFs, making the attack vector authenticated. Nonetheless, the potential for internal network access makes it a risk that should not be ignored.