CVE-2021-39267

MEDIUM 6.1CVE-2021-39267 · Published 18/08/2021 · updated 17/06/2026

In short

CVE-2021-39267 is a MEDIUM (CVSS 6.1) vulnerability affecting suitecrm (salesagility).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.4% of all vulnerabilities.
Fix: update to 7.11.19 or later.

Package	Affected versions	Patched versions
suitecrm salesagility	`< 7.11.19`	`7.11.19`

Description

Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution (such as text/xml) are not blocked.

References

docs.suitecrm.com/admin/releases/7.11.x · Release Notes
salesagility/SuiteCRM · Product
thanhlocpanda.wordpress.com/2021/07/31/file-upload-bypass-suitecrm-7-11-18 · Exploit

More vulnerabilities in suitecrm

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

suitecrm

salesagility

< 7.11.19

7.11.19

Description

More vulnerabilities in suitecrm

See all →