CVE-2026-100358 | SuiteCRM up to 7.15.1/8.10.1 Studio Dropdown Editor html_entity_decode dropdown_name code injection

A vulnerability identified as problematic has been detected in SuiteCRM up to 7.15.1/8.10.1. This affects the function html_entity_decode of the component Studio Dropdown Editor. The manipulation of the argument dropdown_name leads to code injection.

This vulnerability is referenced as CVE-2026-100358. Remote exploitation of the attack is possible. No exploit is available.

You should upgrade the affected component.VulDB Recent EntriesRead More