CVE-2024-1644 is a critical (CVSS 9.9) local file inclusion flaw in SuiteCRM 7.14.2. Fluid Attacks says it can lead to remote command execution for an attacker with minimal privileges. The vendor patched it on 7 June 2024, though the advisory does not name a fixed version, so check the SuiteCRM release page.
What's affected
The record lists SuiteCRM 7.14.2. The Fluid Attacks advisory says a local file inclusion issue exists that, under certain conditions, could let an attacker obtain remote command execution, and that the attacker needs only minimum privileges. Its timeline says the vendor confirmed the issue on 5 June 2024, patched it on 7 June 2024 and the advisory was made public the same day. It links a patch commit and says an updated version is available on the vendor page, without naming a version number.
The NVD score is 9.9 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The record's weakness is CWE-434 (unrestricted upload of file with dangerous type), which reflects the upload step the advisory describes.
How to check if you're exposed
Check the SuiteCRM version in the admin area or from the file system.
grep -n "sugar_version" suitecrm/sugar_version.php
If it reports 7.14.2, you are in the affected set. Then compare your install with the fix commit linked in the advisory, or install the latest release from the vendor page. Review uploaded files in the web root for anything that is not an image or document you expect.
What to do now
- Update SuiteCRM to the current release from the vendor, which includes the 7 June 2024 patch.
- If you cannot update at once, restrict who has accounts and review the permissions of low privileged users.
- Check upload directories for unexpected files and scripts.
- Block execution of scripts from upload directories at the web server.
- Confirm the version afterwards and note the fixed release in your change record.
Why it matters
The advisory pairs two ideas. A file inclusion flaw lets the application load a file by path. An upload feature lets a user put a file on the server. If the application can be made to include an uploaded file as code, the upload becomes code execution.
The score is critical because the network can reach it, the attack is low in complexity, and the privilege needed is low. The record's KEV flag is false and the advisory does not report exploitation. Still, CRM systems hold customer data, so a patch within the week is reasonable. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does it need admin rights?
The advisory says the attacker must have minimum privileges, so a normal low privileged account may be enough.
Sources
Last reviewed: 19 October 2026.
