CVE-2025-68109

Critical

Published: 17/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

ChurchCRM before version 6.5.3 in the Database Restore functionality does not validate the content or file extension of uploaded files. An attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access. Once accessed, the web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

Risk Assessment

The risk includes the possibility of remote code execution on the server, which can lead to full system compromise, data theft, and server takeover.

Recommendation

It is recommended to immediately upgrade ChurchCRM to version 6.5.3 or later and restrict access to the database restore functionality to trusted administrators only.

Original NVD description (English source)

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.