CVE-2026-23698
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Vtiger CRM up to version 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature. An administrator can upload a crafted ZIP archive that extracts arbitrary PHP files into the modules/ directory under the web root without validating file types beyond manifest.xml.
Risk Assessment
An attacker can gain persistent server access via a web shell, bypassing Vtiger CRM's authentication and authorization layer because Apache directly interprets PHP files from the modules/ directory before the request reaches the application routing.
Recommendation
Immediately upgrade Vtiger CRM to a version newer than 8.4.0 if available, restrict administrator account privileges, and implement monitoring of the modules/ directory integrity.
Other vulnerabilities in Vtiger CRM
See all- CVE-2016-1713High
In Vtiger CRM 6.4.0, there is an unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class that allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension.
- CVE-2024-44779Critical
A reflected cross-site scripting (XSS) vulnerability was found in the viewname parameter on the index page of vTiger CRM 7.4.0. It allows an attacker to execute arbitrary JavaScript code in the victim's browser by injecting a crafted payload.
- CVE-2024-44778Critical
A reflected cross-site scripting (XSS) vulnerability exists in the 'parent' parameter of the index page in vTiger CRM 7.4.0. Attackers can execute arbitrary JavaScript code in the victim's browser by injecting a crafted payload.
- CVE-2024-44777Critical
A reflected XSS vulnerability was found in vTiger CRM 7.4.0 in the 'tag' parameter on the index page. An attacker can inject malicious JavaScript that executes in the victim's browser.
- CVE-2026-23697High
Vtiger CRM before version 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file with arbitrary PHP code via the Documents module. The vulnerability is due to the omission of the .phar extension from the denylist in config.inc.php and a misconfigured .htaccess file that is silently ignored on Apache 2.4 deployments.
- CVE-2024-44776Medium
An Open Redirect vulnerability was found in vTiger CRM v7.4.0 in the 'page' parameter. An attacker can craft a URL to redirect users to a malicious site.
Original NVD description (English source)
Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents directly into the modules/ directory under the web root without validating file types beyond the manifest.xml descriptor. Attackers can place executable PHP files in the modules/ directory that become directly accessible via HTTP, bypassing Vtiger's authentication and authorization layer entirely since Apache resolves the path and invokes the PHP interpreter before the application routing layer is involved, resulting in a persistent web shell independent of the originating session.