CVE-2021-42840

8.8 HIGH

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting

Published: 2021-10-22 · Last updated: 2026-06-17

Severity and scoring

CVSS: 8.8 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Affected products

Vendor	Product
salesagility	suitecrm

Description

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-42840
[Exploit reference]http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html
[Vendor advisory]https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19
[Other]https://github.com/rapid7/metasploit-framework/commits/master/modules/exploits/linux/http/suitecrm_log_file_rce.rb
[Vendor advisory]https://suitecrm.com/time-to-upgrade-suitecrm-7-11-19-7-10-30-lts-released/
[Exploit reference]https://theyhack.me/SuiteCRM-RCE-2/
[Exploit reference]http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html
[Vendor advisory]https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19
[Other]https://github.com/rapid7/metasploit-framework/commits/master/modules/exploits/linux/http/suitecrm_log_file_rce.rb
[Vendor advisory]https://suitecrm.com/time-to-upgrade-suitecrm-7-11-19-7-10-30-lts-released/
[Exploit reference]https://theyhack.me/SuiteCRM-RCE-2/

Related CVEs

Same vendor

CVE-2021-41596 — SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal (5.3 MEDIUM)
CVE-2021-41595 — SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal (5.3 MEDIUM)
CVE-2021-41869 — SuiteCRM 7.10.x before 7.10.33 and 7.11.x before 7.11.22 is vulnerable to privilege escalation (8.8 HIGH)
CVE-2021-39268 — Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary Jav... (6.1 MEDIUM)
CVE-2021-39267 — Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary Jav... (6.1 MEDIUM)

Same CWE

CVE-2026-40750 — Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server (9.9 CRITICAL)
CVE-2026-6933 — The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and inclu... (8.8 HIGH)
CVE-2026-40772 — Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions (10.0 CRITICAL)
CVE-2026-39591 — Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions (9.9 CRITICAL)
CVE-2026-39527 — Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions (5.4 MEDIUM)