CVE-2026-23697
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Vtiger CRM before version 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file with arbitrary PHP code via the Documents module. The vulnerability is due to the omission of the .phar extension from the denylist in config.inc.php and a misconfigured .htaccess file that is silently ignored on Apache 2.4 deployments.
Risk Assessment
The organization is at risk of server compromise by an unauthenticated attacker who can execute arbitrary PHP code, potentially leading to data theft, system modification, or further attacks within the internal network.
Recommendation
Immediately upgrade Vtiger CRM to version 8.4.0 or later. Additionally, verify the Apache server configuration to ensure the .htaccess file is properly interpreted and extend the denylist to include the .phar extension.
Other vulnerabilities in Vtiger CRM
See all- CVE-2016-1713High
In Vtiger CRM 6.4.0, there is an unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class that allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension.
- CVE-2024-44779Critical
A reflected cross-site scripting (XSS) vulnerability was found in the viewname parameter on the index page of vTiger CRM 7.4.0. It allows an attacker to execute arbitrary JavaScript code in the victim's browser by injecting a crafted payload.
- CVE-2024-44778Critical
A reflected cross-site scripting (XSS) vulnerability exists in the 'parent' parameter of the index page in vTiger CRM 7.4.0. Attackers can execute arbitrary JavaScript code in the victim's browser by injecting a crafted payload.
- CVE-2024-44777Critical
A reflected XSS vulnerability was found in vTiger CRM 7.4.0 in the 'tag' parameter on the index page. An attacker can inject malicious JavaScript that executes in the victim's browser.
- CVE-2026-23698High
Vtiger CRM up to version 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature. An administrator can upload a crafted ZIP archive that extracts arbitrary PHP files into the modules/ directory under the web root without validating file types beyond manifest.xml.
- CVE-2024-44776Medium
An Open Redirect vulnerability was found in vTiger CRM v7.4.0 in the 'page' parameter. An attacker can craft a URL to redirect users to a malicious site.
Original NVD description (English source)
Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the .phar extension. The uploaded file is stored with its original .phar extension under the web-accessible storage directory, and a misconfigured .htaccess using Apache 2.2 syntax is silently ignored on Apache 2.4 deployments, allowing unauthenticated HTTP requests to directly execute the uploaded PHP payload.