CVE-2026-29109CWE-502

SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing

High · published March 19, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component that allows an authenticated administrator to execute arbitrary system commands on the server. `FilterDefinitionProvider.php` calls `unserialize()` on user-controlled data from the `saved_search.contents` database column without restricting instantiable classes. Version 8.9.3 patches the issue.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00601 · 48.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-03-19T23:12Z
EPSS history
Timeline
  • 19 MAR 23:12Z
    SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing
    cvelistv5