PT-2025-42716 · Churchcrm · Churchcrm

Uartu0 + 1 · Published 2025-10-19 · Updated 2025-10-27 · CVE-2025-11939

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 5.18.0

Description A path traversal issue exists in ChurchCRM due to improper handling of the restoreFile argument within the Backup Restore Handler component, specifically in the file src/ChurchCRM/Backup/RestoreJob.php. This allows for remote exploitation through manipulation of this argument. The vulnerability has been publicly disclosed.

Recommendations Update ChurchCRM to version 5.18.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-11939

Affected Products

Churchcrm

References · 12

• 🔥 https://github.com/uartu0/advisories/blob/main/churchcrm-path-traversal-rce-2025.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-11939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11939 · Security Note
• https://twitter.com/VulmonFeeds/status/1979830072409288878 · Twitter Post
• https://t.me/CVEtracker/35284 · Telegram Post
• https://twitter.com/CVEnew/status/1979830360000061718 · Twitter Post
• https://t.me/cveNotify/139343 · Telegram Post
• https://vuldb.com/?ctiid.329015 · Note
• https://t.me/cveNotify/139465 · Telegram Post
• https://vuldb.com/?submit.671101 · Note
• https://vuldb.com/?id.329015 · Note
• https://t.me/cveNotify/140474 · Telegram Post