SugarCRM Community Edition versions 4.5.1 and 5.0.0 suffer from a local file disclosure vulnerability.