PT-2025-22435 · Vtiger · Vtiger Crm Open Source Edition

Published 2025-05-21 · Updated 2025-12-27 · CVE-2025-45753

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vtiger CRM Open Source Edition version 8.3.0

Description A vulnerability in the software allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature.

Recommendations For Vtiger CRM Open Source Edition version 8.3.0, consider disabling the ZIP import functionality in the Module Import feature until a patch is available. Restrict access to the Module Import feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-45753

Affected Products

Vtiger Crm Open Source Edition

References · 6

• https://osv.dev/vulnerability/CVE-2025-45753 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-45753 · Security Note
• https://t.me/cvenotify/125337 · Telegram Post
• https://simonjuguna.com/cve-2025-45753-authenticated-remote-code-execution-vulnerability-in-vtiger-open-source-edition-v8-3-0 · Note
• https://twitter.com/VulmonFeeds/status/1925401622957506848 · Twitter Post
• https://twitter.com/CVEnew/status/2005031827522642126 · Twitter Post