CVE-2026-40484

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(), which performs no file extension filtering. An authenticated administrator can upload a crafted backup archive containing a PHP webshell inside the Images/ directory, which is then written to a publicly accessible path and executable via HTTP requests, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator. This issue has been fixed in version 7.2.0.

• CWE-269
• CWE-434
• CWE-552

• https://github.com/ChurchCRM/CRM/commit/68be1d12bc4cc1429575ae797ef05efe47030d39
• https://github.com/ChurchCRM/CRM/pull/8610
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-2932-77f9-62fx

Published

Apr 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40479Kimai is an open-source time tracking application. In versio…5.4
• CVE-2026-4048OS Command Injection Remote Code Execution Vulnerability in …7.2
• CVE-2026-40480ChurchCRM is an open-source church management system. In ver…7.1
• CVE-2026-40481monetr is a budgeting application for recurring expenses. In…7.5
• CVE-2026-40482ChurchCRM is an open-source church management system. Versio…7.1
• CVE-2026-40483ChurchCRM is an open-source church management system. In ver…5.4
• CVE-2026-40485ChurchCRM is an open-source church management system. In ver…5.3
• CVE-2026-40486Kimai is an open-source time tracking application. In versio…4.3
• CVE-2026-40487Postiz is an AI social media scheduling tool. Prior to versi…9
• CVE-2026-40488Magento Long Term Support (LTS) is an unofficial, community-…8.8
• CVE-2026-40489editorconfig-core-c is an EditorConfig core library for use…8.6
• CVE-2026-4049Rejected reason: This CVE ID has been rejected or withdrawn …