CVE-2026-40484: ChurchCRM Backup Restore Remote Code Execution via Unfiltered File Copy

Overview

ChurchCRM is an open-source church management system. According to the description in the record, its database backup restore function copies files from the Images/ directory of an uploaded archive into the web-accessible document root without extension filtering. The project's GitHub Security Advisory tracks this issue, and the record lists a fix commit and a pull request.

Impact

• The record states that an authenticated administrator can cause remote code execution as the web server user through a crafted backup archive.
• The restore endpoint lacks CSRF token validation, so the record states that exploitation may also be driven through cross-site request forgery against an authenticated administrator.
• The CNA-provided CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, with a base score of 9.1 and severity critical.
• The record maps the weakness to CWE-269, Improper Privilege Management.

Affected products and versions

The description identifies ChurchCRM versions prior to 7.2.0 as affected. The structured affected list in the record is empty, so any finer version range is unknown. The description states that the issue is fixed in version 7.2.0.

Exploitation status

The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability in the record is 0.00987, with a percentile of 0.61436, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

• Upgrade ChurchCRM to version 7.2.0 or later, which the description identifies as the fixed release.
• Restrict administrator accounts to trusted staff and review existing administrator access, since the record requires an authenticated administrator.
• Avoid restoring backup archives from untrusted or unverified sources.
• As an inference from the described mechanism, verify that the web server does not execute PHP files in upload and image directories until the upgrade is applied.

Detection guidance

• Review the Images/ directory and the web document root for unexpected PHP or other executable files, especially files with recent modification times.
• Review application and web server logs around backup restore operations for unexpected restores or requests to unfamiliar files.
• Monitor for unexpected administrator actions that were not initiated by the user, which may indicate cross-site request forgery.

Limitations of the available information

• The record's title field is empty, and the structured affected and fixed version lists are empty, so this analysis relies on the description text.
• The record does not provide exploit details, proof-of-concept material or vendor-specific workarounds, and none are included here.
• The record's CVSS vector sets the privileges required to High, while the description describes exploitation by an authenticated administrator; both are reported as recorded.
• The record does not indicate whether any backup restore feature exists in releases from other forks or deployments.

Frequently asked questions

Which ChurchCRM versions are affected by this issue?

The description states that versions prior to 7.2.0 are affected. The structured affected version list in the record is empty, so finer ranges are unknown.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

What is the recommended action?

Upgrade to ChurchCRM 7.2.0 or later, restrict administrator accounts, avoid restoring untrusted backups, and check the Images/ and web root for unexpected PHP files.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.