PT-2026-56207 · Vtiger · Vtiger Crm

Jiva · Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-23697

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the .phar extension. The uploaded file is stored with its original .phar extension under the web-accessible storage directory, and a misconfigured .htaccess using Apache 2.2 syntax is silently ignored on Apache 2.4 deployments, allowing unauthenticated HTTP requests to directly execute the uploaded PHP payload.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-23697

Affected Products

Vtiger Crm

References · 4

• 🔥 https://jivasecurity.com/writeups/vtiger-rce-phar-upload-cve-2026-23697 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23697 · Security Note
• https://vulncheck.com/advisories/vtiger-crm-authenticated-file-upload-rce-via-documents-module · Note
• https://vtiger.com · Note