CVE-2026-35573

CRITICAL

9.1

Description

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.

Details CVE

Score CVSS v3.19.1

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisHIGH

Interaction utilisateurNONE

Publie4/7/2026

Derniere modification4/10/2026

Sourcenvd

Observations honeypot0

Produits affectes

churchcrm:churchcrm

Faiblesses (CWE)

CWE-22CWE-434

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx(security-advisories@github.com)

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.