CVE-2026-58409 Details
Description
ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist (DENIED_EXTENSIONS) fails to block standard .php files. Because `php` is explicitly included in the allowed extension list for plugin archives, and extracted files are placed directly under the web root, any PHP file inside the ZIP becomes immediately executable via HTTP — without even needing to "enable" the plugin through the application UI. The /plugins/install-url API route (management.php) allows an administrator to source the malicious ZIP from any attacker-controlled HTTPS URL, validating it only against an attacker-supplied SHA-256 hash. This issue has been fixed in version 7.4.0.
A remote code execution vulnerability has been identified in ChurchCRM versions prior to 7.4.0. The issue arises from the plugin installation process, where an authenticated administrator can upload a ZIP archive containing a PHP web shell. The application improperly validates file extensions, allowing PHP files to be executed immediately after extraction, without needing to activate the plugin through the user interface. This vulnerability is exploited by uploading the malicious ZIP file via the '/plugins/api/plugins/install-url' API route, which only checks the file against a user-provided SHA-256 hash.
ChurchCRM has released a patch in version 7.4.0, which blocks the extraction of server-executable file extensions from plugin archives. Administrators are advised to upgrade to this version immediately.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-37mf-vq43-5qp9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-37mf-vq43-5qp9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ChurchCRM | <= 7.3.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |