CVE-2026-35573 - Vulnerability Analysis

Overview

ChurchCRM < 6.5.3 contains a path traversal vulnerability caused by insufficient validation of user-controlled file names in backup restore functionality, letting authenticated administrators achieve remote code execution by overwriting Apache .htaccess files.

Severity & Score

Impact

Authenticated administrators can execute arbitrary code remotely by uploading malicious files, potentially compromising the server.

Mitigation

Upgrade to version 6.5.3 or later.

References

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner