CVE-2026-23697 Details
Description
Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the .phar extension. The uploaded file is stored with its original .phar extension under the web-accessible storage directory, and a misconfigured .htaccess using Apache 2.2 syntax is silently ignored on Apache 2.4 deployments, allowing unauthenticated HTTP requests to directly execute the uploaded PHP payload.
An authenticated file upload vulnerability has been identified in Vtiger CRM versions prior to 8.4.0. This vulnerability allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module. The vulnerability bypasses the extension denylist in config.inc.php, which omits the .phar extension. The uploaded file is stored with its original .phar extension in a web-accessible directory. Additionally, a misconfigured .htaccess file, using Apache 2.2 syntax, is ignored on Apache 2.4 deployments, allowing unauthenticated HTTP requests to execute the uploaded PHP payload directly.
Users are advised to update to Vtiger CRM 8.4.0 or later. For those using earlier versions, it is recommended to add .phar and other executable extensions to the upload blacklist, update the .htaccess file in the storage directory to Apache 2.4 syntax, and disable directory listing.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jivasecurity.com/writeups/vtiger-rce-phar-upload-cve-2026-23697 | [email protected] | ExploitTechnical Analysis |
| https://www.vtiger.com/ | [email protected] | Permission RequiredVendor |
| https://www.vulncheck.com/advisories/vtiger-crm-authenticated-file-upload-rce-via-documents-module | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vtiger CRM | < 8.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |