CVE-2005-4086: SugarCRM Sugar Suite

Medium severity, CVSS 5.0. EPSS: 7.3% chance of exploitation in the next 30 days.

Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the beanFiles array parameter.

Affected products

• SugarCRM Sugar Suite: version 3.5 only; version 4.0_beta only

Published 2005-12-08. Last modified 2026-06-16.