Remote Code Execution Vulnerability in ChurchCRM by ChurchCRM
CVE-2026-58409

9.1CRITICAL

Key Information:

Vendor

Churchcrm

Status
Crm
Vendor
CVE Published:
13 July 2026

What is CVE-2026-58409?

ChurchCRM, an open-source church management system, has a vulnerability that enables authenticated administrators to execute arbitrary code on the server. By uploading a malicious plugin ZIP archive that contains a PHP webshell, attackers can exploit the application's design flaw. The application uniquely allows 'php' in its ALLOWED_EXTENSIONS list, while failing to adequately restrict harmful file types in its DENIED_EXTENSIONS list. This oversight permits PHP files within the ZIP to be executed directly from the web root, without requiring enabling through the user interface. Additionally, the /plugins/install-url API endpoint allows administrators to source malicious ZIP files from attacker-controlled URLs, merely validating them against an attacker-provided SHA-256 hash. This vulnerability has been addressed in version 7.4.0.

Affected Version(s)

CRM < 7.4.0

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.