CVE-2026-39337

ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pm2v-ggh4-mp7p	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de la versión 7.1.0, una vulnerabilidad crítica de ejecución remota de código pre-autenticación en el asistente de configuración de ChurchCRM permite a atacantes no autenticados inyectar código PHP arbitrario durante el proceso de instalación inicial, lo que lleva a la completa compromiso del servidor. La variable ’$dbPassword’ no está saneada. Esta vulnerabilidad existe debido a una corrección incompleta para CVE-2025-62521. Esta vulnerabilidad se corrigió en la versión 7.1.0.

Information

Published : 2026-04-07 18:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-39337

Mitre link : CVE-2026-39337

CVE.ORG link : CVE-2026-39337

JSON object : View

Products Affected

churchcrm

churchcrm

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-39337", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39337", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T18:41:44.298078Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ChurchCRM", "product": "CRM", "versions": [{"status": "affected", "version": "< 7.1.0"}]}]}], "published": "2026-04-07T18:16:45.630", "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pm2v-ggh4-mp7p", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The \"$dbPassword\" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0."}, {"lang": "es", "value": "ChurchCRM es un sistema de gesti\u00f3n de iglesias de c\u00f3digo abierto. Antes de la versi\u00f3n 7.1.0, una vulnerabilidad cr\u00edtica de ejecuci\u00f3n remota de c\u00f3digo pre-autenticaci\u00f3n en el asistente de configuraci\u00f3n de ChurchCRM permite a atacantes no autenticados inyectar c\u00f3digo PHP arbitrario durante el proceso de instalaci\u00f3n inicial, lo que lleva a la completa compromiso del servidor. La variable \u2019$dbPassword\u2019 no est\u00e1 saneada. Esta vulnerabilidad existe debido a una correcci\u00f3n incompleta para CVE-2025-62521. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 7.1.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF846F61-0C1E-49AB-B691-A01937A6C24D", "versionEndExcluding": "7.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}