ChurchCRM RCE: Unauthenticated Admin Exploit via Backup Restore

The National Vulnerability Database (NVD) has detailed CVE-2026-40484, a critical remote code execution (RCE) vulnerability in ChurchCRM, an open-source church management system. Versions prior to 7.2.0 are affected. The flaw lies within the database backup restore functionality, which extracts archive contents and copies files from the Images/ directory to the web-accessible document root without proper file extension filtering.

An authenticated administrator can exploit this by uploading a crafted backup archive containing a PHP webshell within the Images/ directory. This webshell then gets written to a publicly accessible path, making it executable via HTTP requests and resulting in RCE as the web server user. The NVD also notes that the restore endpoint lacks CSRF token validation, enabling cross-site request forgery attacks targeting an authenticated administrator.

This is a severe issue. While it requires administrator authentication, the CSRF component significantly lowers the bar for exploitation. Attackers can leverage social engineering to trick an authenticated admin into triggering the vulnerable restore operation. The impact is complete system compromise, given the RCE capability.