PT-2026-56207 · Vtiger · Vtiger Crm

Jiva · Publicado 2026-07-07 · Atualizado 2026-07-07 · CVE-2026-23697

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the .phar extension. The uploaded file is stored with its original .phar extension under the web-accessible storage directory, and a misconfigured .htaccess using Apache 2.2 syntax is silently ignored on Apache 2.4 deployments, allowing unauthenticated HTTP requests to directly execute the uploaded PHP payload.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-23697

Produtos afetados

Vtiger Crm

Referências · 4

• 🔥 https://jivasecurity.com/writeups/vtiger-rce-phar-upload-cve-2026-23697 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23697 · Nota de Segurança
• https://vulncheck.com/advisories/vtiger-crm-authenticated-file-upload-rce-via-documents-module · Nota
• https://vtiger.com · Nota