Description
ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.
Affected products
churchcrm: churchcrm
References2
- github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx ExploitThird Party Advisory
- github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
9.1
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 57 · as of 12 November 2026
- CWE
- CWE-22CWE-434
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.