CVE-2026-40484 Details

A remote code execution vulnerability has been identified in ChurchCRM, an open-source church management system, in versions prior to 7.2.0. The issue arises in the database backup restore functionality, where uploaded archive contents are extracted and files from the Images directory are copied into the web-accessible document root without any file extension filtering. This flaw allows an authenticated administrator to upload a malicious backup archive containing a PHP web shell, which is then written to a publicly accessible path and can be executed via HTTP requests. The vulnerability is exacerbated by the restore endpoint's lack of CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator.

Users can update to ChurchCRM version 7.2.0 or later, where this vulnerability has been fixed. Instructions for updating can be found in the ChurchCRM documentation.