CVE-2023-22952: SugarCRM EmailTemplates input validation flaw allows PHP code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is network-reachable remote code execution, listed in CISA KEV with a very high EPSS score and public exploit code, making active exploitation likely.

What it is

SugarCRM before 12.0 Hotfix 91155 fails to validate input in EmailTemplates, letting a crafted request inject custom PHP code. Because the injected code runs on the server, this is a remote code execution flaw in a widely deployed CRM. The record does not list specific affected versions beyond the fix threshold.

Impact

An attacker can execute arbitrary PHP on the SugarCRM server, leading to full compromise of the application and its data. This can enable webshell deployment, data theft, and lateral movement into connected systems.

Attack surface

The CVSS vector is network-reachable (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), so an authenticated low-privileged user can reach the vulnerable EmailTemplates functionality. No details on the exact endpoint or request shape are provided in the record.

Exploitation

CVE-2023-22952 is listed in CISA KEV with a due date of 2023-02-23, and EPSS shows a 30-day probability of 0.80139 (99.6th percentile). Public exploit references are tagged Exploit, indicating working exploit code is available.

What to do

• Apply the vendor fix by upgrading SugarCRM to 12.0 Hotfix 91155 or later per the vendor advisory.
• If immediate patching is not possible, restrict access to the EmailTemplates functionality to trusted administrative users only.
• Review and remove any unexpected PHP files or webshells in the SugarCRM web root and upload directories.
• Rotate credentials and secrets that may have been exposed if compromise is suspected.
• Monitor for and block exploit attempts targeting EmailTemplates endpoints at the WAF or reverse proxy.

Detection

• Search web server and application logs for unusual POST requests to EmailTemplates endpoints, especially those containing PHP code or file-write patterns.
• Monitor the SugarCRM web root and upload directories for newly created or modified PHP files.
• Alert on unexpected outbound connections or process execution from the SugarCRM server.
• Correlate authentication logs for low-privileged accounts accessing EmailTemplates administration features.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.