CVE-2026-40484: ChurchCRM RCE Vulnerability

CVE-2026-40484 Overview

CVE-2026-40484 is a critical remote code execution vulnerability affecting ChurchCRM, an open-source church management system. The vulnerability exists in the database backup restore functionality, which extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(). This function performs no file extension filtering, allowing an authenticated administrator to upload a crafted backup archive containing a PHP webshell inside the Images/ directory. The malicious file is then written to a publicly accessible path and becomes executable via HTTP requests, resulting in remote code execution as the web server user.

The vulnerability is further exacerbated by the lack of CSRF token validation on the restore endpoint, enabling exploitation through cross-site request forgery attacks targeting authenticated administrators.

Critical Impact

Authenticated administrators can achieve remote code execution on the underlying web server, potentially compromising the entire system and sensitive church member data. The missing CSRF protection allows attackers to exploit this vulnerability without direct admin credentials by tricking administrators into visiting malicious pages.

Affected Products

• ChurchCRM versions prior to 7.2.0

Discovery Timeline

• April 18, 2026 - CVE-2026-40484 published to NVD
• April 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40484

Vulnerability Analysis

This vulnerability represents a dangerous combination of insecure file handling and missing security controls. The core issue lies in the recursiveCopyDirectory() function used during the backup restore process. When an administrator initiates a database restore from an uploaded archive, the system extracts the archive contents and recursively copies files from the Images/ directory into the web-accessible document root.

The critical flaw is the absence of any file extension filtering or validation during this copy operation. This allows executable files such as PHP webshells to be included in the archive's Images/ directory, subsequently placed in a publicly accessible location where they can be executed via direct HTTP requests.

The vulnerability is classified under CWE-269 (Improper Privilege Management), as the backup restore functionality grants excessive file system privileges without proper validation of the content being restored.

Root Cause

The root cause of this vulnerability is the failure to implement proper input validation and file type restrictions in the backup restore functionality. The recursiveCopyDirectory() function blindly copies all files from the extracted archive without checking file extensions, MIME types, or file content. Combined with the missing CSRF token validation on the restore endpoint, this creates a high-severity attack surface.

The absence of defense-in-depth measures—such as restricting executable permissions on the Images/ directory or implementing content-type validation—compounds the issue.

Attack Vector

An attacker can exploit this vulnerability through two primary attack scenarios:

1. Direct exploitation by authenticated admin: A malicious or compromised administrator can craft a backup archive containing a PHP webshell in the Images/ directory, upload it through the restore functionality, and then access the webshell via HTTP to execute arbitrary commands.

2. CSRF-based exploitation: Due to the missing CSRF token validation, an attacker can create a malicious webpage that triggers the backup restore operation when visited by an authenticated ChurchCRM administrator. This allows exploitation without requiring direct admin credentials.

The malicious archive structure would include a PHP file within the Images/ directory path. When the restore operation completes, this file becomes accessible at the web root, allowing the attacker to execute arbitrary PHP code with the privileges of the web server user.

For technical details on the exploitation mechanism and patch implementation, refer to the GitHub Security Advisory GHSA-2932.

Detection Methods for CVE-2026-40484

Indicators of Compromise

• Unexpected PHP files appearing in the Images/ directory or web root after backup restore operations
• Web server access logs showing requests to unusual PHP files in the Images/ directory
• Backup restore operations initiated from unexpected IP addresses or during unusual hours
• Suspicious POST requests to the backup restore endpoint with archive uploads

Detection Strategies

• Monitor file system changes in the ChurchCRM web directory, particularly for new PHP files in the Images/ folder
• Implement web application firewall (WAF) rules to detect and block requests to executable files in image directories
• Review web server access logs for requests to PHP files in directories that should only contain static content
• Deploy file integrity monitoring to alert on unauthorized modifications to the web application directory

Monitoring Recommendations

• Enable detailed logging for the ChurchCRM backup and restore functionality
• Configure alerts for any file creation events in the Images/ directory with executable extensions (.php, .phtml, .phar)
• Monitor for outbound network connections from the web server that could indicate webshell activity
• Implement endpoint detection and response (EDR) solutions to identify post-exploitation activities

How to Mitigate CVE-2026-40484

Immediate Actions Required

• Upgrade ChurchCRM to version 7.2.0 or later immediately
• Review file system for any unexpected PHP files in the Images/ directory and web root
• Audit backup restore logs for any suspicious activity
• Implement CSRF protection if using a custom deployment or awaiting upgrade

Patch Information

This vulnerability has been addressed in ChurchCRM version 7.2.0. The fix implements proper file extension filtering in the backup restore functionality and adds CSRF token validation to the restore endpoint. For detailed patch information, see the GitHub commit and the associated pull request.

Workarounds

• Restrict access to the backup restore functionality to only essential personnel and trusted network locations
• Configure web server to deny execution of PHP files in the Images/ directory using directory-specific configuration
• Implement network-level access controls to limit who can access the ChurchCRM administrative interface
• Deploy a web application firewall to filter malicious archive uploads

# Apache configuration to prevent PHP execution in Images directory
<Directory "/var/www/churchcrm/Images">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
    php_flag engine off
</Directory>