CVE-2026-40484

{
  "id": "CVE-2026-40484",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-18T00:16:39.387",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(), which performs no file extension filtering. An authenticated administrator can upload a crafted backup archive containing a PHP webshell inside the Images/ directory, which is then written to a publicly accessible path and executable via HTTP requests, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator. This issue has been fixed in version 7.2.0."
    },
    {
      "lang": "es",
      "value": "ChurchCRM es un sistema de gestión de iglesias de código abierto. En versiones anteriores a la 7.2.0, la funcionalidad de restauración de copias de seguridad de la base de datos extrae el contenido de los archivos subidos y copia archivos del directorio Images/ en la raíz del documento accesible por la web usando recursiveCopyDirectory(), que no realiza ningún filtrado de extensión de archivo. Un administrador autenticado puede subir un archivo de copia de seguridad manipulado que contiene una webshell PHP dentro del directorio Images/, que luego se escribe en una ruta de acceso público y es ejecutable mediante peticiones HTTP, lo que resulta en ejecución remota de código como el usuario del servidor web. El endpoint de restauración también carece de validación de token CSRF, lo que permite la explotación mediante falsificación de petición en sitios cruzados dirigida a un administrador autenticado. Este problema ha sido corregido en la versión 7.2.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ChurchCRM",
          "product": "CRM",
          "versions": [
            {
              "version": "< 7.2.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T14:45:34.816821Z",
          "id": "CVE-2026-40484",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        },
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ChurchCRM/CRM/commit/68be1d12bc4cc1429575ae797ef05efe47030d39",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChurchCRM/CRM/pull/8610",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-2932-77f9-62fx",
      "source": "[email protected]"
    }
  ]
}