CVE-2026-35573 ChurchCRM has a Path traversal leads to RCE
Authenticated administrators can exploit path traversal in backup restore to upload arbitrary files, overwrite .htaccess, and achieve remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35573?
CVE-2026-35573 is a critical path traversal vulnerability in Churchcrm Churchcrm, published on 7 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.
Which versions are affected by CVE-2026-35573?
It affects 1 product.
Products include Churchcrm Churchcrm.
How do I fix CVE-2026-35573?
No fix has been published for CVE-2026-35573 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-35573 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35573 exists.
Other vulnerabilities in Churchcrm Churchcrm
Sources
Also known as GHSA-r6cr-mvr9-f6wx.