PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5219 Sagecrm CVE debrief

CVE-2017-5219 is a critical SageCRM issue publicly disclosed on 2017-02-02. The vulnerable Component Manager accepted ZIP uploads containing a valid .ecf component file, then extracted content in a way that could be abused for path traversal. As described in the CVE record, an attacker could place additional files outside the intended inf directory and into the webroot, enabling remote interaction with the underlying filesystem at SYSTEM privilege.

Vendor
Sagecrm
Product
CVE-2017-5219
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-02
Original CVE updated
2026-05-13
Advisory published
2017-02-02
Advisory updated
2026-05-13

Who should care

Organizations running SageCRM 7.3, 7.3 SP1, or 7.3 SP2 should treat this as high priority. Security teams responsible for web application hardening, file upload controls, and incident response should also review systems that exposed the Component Manager functionality.

Technical summary

The issue is a ZIP extraction/path traversal flaw in SageCRM Component Manager (CWE-22). NVD lists SageCRM 7.3, 7.3 SP1, and 7.3 SP2 as vulnerable. The CVE description states that a ZIP file containing a valid .ecf file could pass validation while still carrying additional files that were extracted outside the intended location. Because the extraction process could traverse directories, attacker-supplied files could reach the SageCRM webroot, creating a path to arbitrary file placement and full impact on confidentiality, integrity, and availability.

Defensive priority

Immediate for any exposed SageCRM 7.x deployment running a listed vulnerable version. The combination of network reachability, no required privileges, no user interaction, and SYSTEM-level impact makes this a top-priority remediation item.

Recommended defensive actions

  • Upgrade SageCRM to 7.3 SP3 or later, or otherwise move to a vendor-supported version not listed as vulnerable.
  • Restrict or disable Component Manager access where possible, especially for untrusted users.
  • Review file-upload and archive-extraction handling for path traversal protections; ensure extracted paths are normalized and constrained to intended directories.
  • Inspect SageCRM webroot and related directories for unexpected files, especially suspicious ASP or other executable content and traversal-style filenames.
  • Review authentication logs, application logs, and filesystem change records for abnormal component uploads or extraction events.
  • If compromise is suspected, isolate the host, preserve evidence, rotate credentials, and consider rebuilding the system from trusted media.

Evidence notes

This debrief is limited to the supplied CVE/NVD corpus. The CVE description explicitly states that SageCRM Component Manager could accept a ZIP containing a valid .ecf file, and that additional files in the archive could be extracted outside the inf directory into the webroot. The description also states the resulting filesystem interaction could occur with SYSTEM privilege. NVD marks the weakness as CWE-22 and lists affected versions as SageCRM 7.3, 7.3 SP1, and 7.3 SP2. Third-party advisory and VDB references are present in the NVD record, but their page contents were not fetched here.

Official resources

Publicly disclosed on 2017-02-02, per the supplied CVE published date.