CVE-2026-39337: ChurchCRM RCE Vulnerability

CVE-2026-39337 Overview

CVE-2026-39337 is a critical pre-authentication remote code execution (RCE) vulnerability affecting ChurchCRM, an open-source church management system. Prior to version 7.1.0, the setup wizard contains a code injection flaw that allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise.

The vulnerability stems from improper sanitization of the $dbPassword variable, which can be exploited to inject malicious PHP code. Notably, this vulnerability exists due to an incomplete fix for CVE-2025-62521, indicating the original remediation did not fully address all attack vectors.

Critical Impact

Unauthenticated attackers can achieve complete server compromise by injecting arbitrary PHP code during ChurchCRM installation, potentially gaining full control of the underlying system without any authentication requirements.

Affected Products

• ChurchCRM versions prior to 7.1.0
• ChurchCRM installations with accessible setup wizard endpoints
• Servers running ChurchCRM in installation or reconfiguration state

Discovery Timeline

• 2026-04-07 - CVE-2026-39337 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39337

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code, or 'Code Injection'). The flaw resides in ChurchCRM's setup wizard, a component that runs during initial installation and typically operates without authentication requirements.

The core issue is that the $dbPassword variable is not properly sanitized before being incorporated into PHP code or configuration files during the setup process. An attacker who can access the setup wizard endpoint can craft malicious input that breaks out of the intended string context and injects arbitrary PHP code.

Because this is a pre-authentication vulnerability affecting the installation wizard, the attack surface includes any ChurchCRM instance that has not completed installation, or potentially systems where the setup wizard remains accessible after installation. The scope change indicated in the security assessment means successful exploitation can affect resources beyond the vulnerable component itself—essentially compromising the entire server.

Root Cause

The root cause is insufficient input validation and sanitization of the $dbPassword parameter within the setup wizard's code generation or configuration writing functionality. This represents an incomplete fix for the previously identified CVE-2025-62521, suggesting that while some sanitization was added, additional injection vectors or bypass techniques remained exploitable.

When user-supplied database credentials are processed, the password value is incorporated into generated PHP files without adequate escaping or validation, allowing specially crafted input to inject executable code.

Attack Vector

The attack vector is network-based and requires no authentication, privileges, or user interaction. An attacker with network access to a ChurchCRM installation can target the setup wizard endpoint directly.

The exploitation mechanism involves:

1. Accessing the ChurchCRM setup wizard endpoint on a target server
2. Submitting a specially crafted database password value containing PHP code injection payload
3. The malicious payload is written into configuration files or processed by the server
4. The injected PHP code executes with the web server's privileges, providing the attacker with remote code execution capabilities

The vulnerability is particularly dangerous because setup wizards are designed to be accessible without authentication, and many organizations may leave installation endpoints accessible longer than necessary or fail to properly secure them after deployment.

Detection Methods for CVE-2026-39337

Indicators of Compromise

• Unexpected access to ChurchCRM setup wizard endpoints (/setup/, /Install/, or similar paths)
• Web server logs showing POST requests to installation endpoints with unusual or encoded payload data in password fields
• Newly created or modified PHP files in the ChurchCRM installation directory
• Web shell artifacts or unauthorized PHP files appearing on the server

Detection Strategies

• Monitor web application firewall (WAF) logs for requests targeting ChurchCRM setup or installation endpoints
• Implement file integrity monitoring on ChurchCRM installation directories to detect unauthorized PHP file creation or modification
• Review web server access logs for suspicious patterns involving setup wizard URLs, particularly with encoded or special characters in POST parameters
• Deploy network intrusion detection rules to identify code injection patterns in HTTP traffic to ChurchCRM installations

Monitoring Recommendations

• Configure alerting for any access to setup wizard endpoints on production ChurchCRM instances
• Establish baseline file hashes for ChurchCRM installation and alert on any changes to PHP configuration files
• Monitor process execution on web servers for unexpected child processes spawned by the web server user
• Implement logging for all database connection attempts and configuration changes within ChurchCRM

How to Mitigate CVE-2026-39337

Immediate Actions Required

• Upgrade ChurchCRM to version 7.1.0 or later immediately
• Restrict or disable access to ChurchCRM setup wizard endpoints through web server configuration
• Audit existing ChurchCRM installations for signs of compromise, including unauthorized PHP files or configuration changes
• Implement network-level access controls to limit who can reach ChurchCRM administrative and setup endpoints

Patch Information

ChurchCRM has addressed this vulnerability in version 7.1.0. Organizations should update to this version or later to remediate the code injection flaw. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Block access to setup wizard endpoints at the web server or reverse proxy level using location-based access controls
• Remove or rename setup wizard files after completing installation to prevent reactivation
• Implement IP-based restrictions to allow setup wizard access only from trusted administrative networks
• Place ChurchCRM behind a VPN or authentication gateway to prevent unauthenticated access to any installation endpoints

# Example: Block setup wizard access in Apache .htaccess
<Directory "/var/www/churchcrm/Setup">
    Order Deny,Allow
    Deny from all
    # Allow only from specific admin IP if setup is needed
    # Allow from 192.168.1.100
</Directory>