Path Traversal in Churchcrm

CVE-2026-35573

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.

Vulnerability class: Path Traversal (Directory Traversal)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.009 (59.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 59.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-35573: held from 0.008 to 0.009.

EPSS over last 30 days · oldest: 0.008 · newest: 0.009 · change: +0.002

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-35573?
CVE-2026-35573 is a critical-severity vulnerability in Churchcrm, classified under Path Traversal. CVSS score: 9.1/10. Published 2026-04-07.
How severe is CVE-2026-35573?
Critical severity. CVSS v3 base score is 9.1 out of 10.