Path Traversal in Churchcrm
CVE-2026-35573
ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.008 (53.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Churchcrm
- Churchcrm Crm — versions < 6.5.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-35573?
- CVE-2026-35573 is a critical-severity vulnerability in Churchcrm, classified under Path Traversal. CVSS score: 9.1/10. Published 2026-04-07.
- How severe is CVE-2026-35573?
- Critical severity. CVSS v3 base score is 9.1 out of 10.