PT-2026-30940 · Churchcrm · Churchcrm

Uartu0 · CVE-2026-35573 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM, an open-source church management system, contains a path traversal flaw in its backup restore functionality. Authenticated administrators can exploit this to upload arbitrary files and potentially achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability resides in the RestoreJob.php file within the src/ChurchCRM/Backup/RestoreJob.php path. The $rawUploadedFile['name'] parameter is user-controlled, enabling the upload of files with arbitrary names to the /var/www/html/tmp attach/ChurchCRMBackups/ directory.

Recommendations Update ChurchCRM to version 6.5.3 or later.

Exploit

Fix

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

CVE-2026-35573

GHSA-R6CR-MVR9-F6WX

Affected Products

Churchcrm

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35573.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35573 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35573 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2041587554198126745 · Twitter Post
• https://twitter.com/CVEnew/status/2041569963270680866 · Twitter Post
• https://twitter.com/0dayPublishing/status/2041571599329947773 · Twitter Post