CVE-2026-35573

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx	Exploit Third Party Advisory
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de 6.5.3, una vulnerabilidad de salto de ruta en la funcionalidad de restauración de copias de seguridad de ChurchCRM permite a los administradores autenticados subir archivos arbitrarios y lograr la ejecución remota de código sobrescribiendo los archivos de configuración .htaccess de Apache. La vulnerabilidad existe en src/ChurchCRM/Backup/RestoreJob.PHP. El parámetro $rawUploadedFile[’name’] es controlado por el usuario y permite subir archivos con nombres arbitrarios a /var/www/html/tmp_attach/ChurchCRMBackups/. Esta vulnerabilidad se corrigió en 6.5.3.

Information

Published : 2026-04-07 18:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-35573

Mitre link : CVE-2026-35573

CVE.ORG link : CVE-2026-35573

JSON object : View

Products Affected

churchcrm

churchcrm

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2026-35573", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35573", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T18:49:42.771781Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 6.5.3"}]}]}], "published": "2026-04-07T18:16:41.760", "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. Antes de 6.5.3, una vulnerabilidad de salto de ruta en la funcionalidad de restauraci\u00f3n de copias de seguridad de ChurchCRM permite a los administradores autenticados subir archivos arbitrarios y lograr la ejecuci\u00f3n remota de c\u00f3digo sobrescribiendo los archivos de configuraci\u00f3n .htaccess de Apache. La vulnerabilidad existe en src/ChurchCRM/Backup/RestoreJob.PHP. El par\u00e1metro $rawUploadedFile[\u2019name\u2019] es controlado por el usuario y permite subir archivos con nombres arbitrarios a /var/www/html/tmp_attach/ChurchCRMBackups/. Esta vulnerabilidad se corrigi\u00f3 en 6.5.3."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B1435CA-1370-4154-85E0-6AF1846DEEBD", "versionEndExcluding": "6.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}