CVE-2026-35573: ChurchCRM Path Traversal RCE Vulnerability

CVE-2026-35573 Overview

CVE-2026-35573 is a critical path traversal vulnerability in ChurchCRM, an open-source church management system. Prior to version 6.5.3, the backup restore functionality contains a flaw that allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php, where the $rawUploadedFile['name'] parameter is user-controlled, enabling attackers to upload files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/.

Critical Impact

Authenticated administrators can exploit this path traversal vulnerability to achieve remote code execution by uploading malicious files and overwriting critical web server configuration files.

Affected Products

• ChurchCRM versions prior to 6.5.3

Discovery Timeline

• 2026-04-07 - CVE-2026-35573 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35573

Vulnerability Analysis

This vulnerability represents a classic path traversal attack (CWE-22) combined with arbitrary file upload capabilities, creating a direct path to remote code execution. The weakness resides in the backup restoration process where user-supplied filenames are not properly sanitized before being used in file system operations.

The vulnerable code in src/ChurchCRM/Backup/RestoreJob.php accepts the $rawUploadedFile['name'] parameter directly from user input. Without adequate validation, an attacker can craft a filename containing directory traversal sequences (such as ../) to escape the intended upload directory and write files to arbitrary locations on the server.

While this vulnerability requires administrator-level authentication to exploit, the impact is severe because it allows complete server compromise. An attacker with administrator credentials can leverage this flaw to overwrite Apache .htaccess files, effectively reconfiguring the web server to execute arbitrary code or redirect traffic.

Root Cause

The root cause of CVE-2026-35573 is improper input validation in the backup restore functionality. The application fails to sanitize or validate the filename parameter before using it in file system operations. Specifically, the $rawUploadedFile['name'] variable is passed directly to file handling functions without removing or blocking path traversal sequences like ../ or ..\\. This allows an attacker to control the destination path where uploaded files are written, breaking out of the intended /var/www/html/tmp_attach/ChurchCRMBackups/ directory.

Attack Vector

The attack vector involves an authenticated administrator crafting a malicious backup file with a specially crafted filename containing path traversal sequences. The exploitation flow is as follows:

1. An attacker with administrator credentials accesses the backup restore functionality
2. The attacker uploads a file with a crafted filename such as ../../../var/www/html/.htaccess
3. The application writes the file to the attacker-controlled path instead of the intended backup directory
4. By overwriting the .htaccess file, the attacker can configure Apache to execute PHP code from uploaded files or redirect application behavior
5. The attacker then uploads a malicious PHP webshell and gains remote code execution on the server

For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-35573

Indicators of Compromise

• Suspicious file uploads containing path traversal sequences (../) in the filename
• Unexpected modifications to .htaccess files in the web root or other directories
• Presence of unfamiliar PHP files or webshells in web-accessible directories
• Unusual administrative activity in ChurchCRM backup restore logs
• Apache configuration changes that enable execution of uploaded files

Detection Strategies

• Monitor web server logs for requests to the backup restore endpoint with unusual filename parameters
• Implement file integrity monitoring on critical configuration files including .htaccess
• Configure web application firewalls (WAF) to detect and block path traversal sequences in file upload parameters
• Review ChurchCRM audit logs for suspicious administrator backup restore operations
• Deploy endpoint detection and response (EDR) solutions to identify unexpected file writes outside designated directories

Monitoring Recommendations

• Enable detailed logging for file system operations on the ChurchCRM server
• Set up alerts for any modifications to .htaccess files or Apache configuration
• Monitor for new or modified PHP files in web-accessible directories
• Implement real-time alerting for backup restore operations performed outside of maintenance windows

How to Mitigate CVE-2026-35573

Immediate Actions Required

• Upgrade ChurchCRM to version 6.5.3 or later immediately
• Review administrator accounts and remove unnecessary elevated privileges
• Audit recent backup restore operations for signs of exploitation
• Verify the integrity of .htaccess files and other critical configuration files
• Consider temporarily restricting access to the backup restore functionality until patching is complete

Patch Information

ChurchCRM has released version 6.5.3 which addresses this vulnerability by implementing proper input validation for uploaded filenames. The patch sanitizes the $rawUploadedFile['name'] parameter to prevent path traversal sequences from being used to write files outside the intended backup directory.

Organizations running ChurchCRM should update to version 6.5.3 or later. For more information, refer to the GitHub Security Advisory.

Workarounds

• Restrict access to the backup restore functionality to only essential personnel
• Implement network-level access controls to limit which IP addresses can access administrative functions
• Deploy a web application firewall (WAF) configured to block path traversal sequences in file upload requests
• Enable file integrity monitoring on the web root directory to detect unauthorized file modifications
• Consider disabling the backup restore feature entirely until the patch can be applied