Which versions of Vtiger CRM are affected by CVE-2026-23697?

Vtiger CRM instances prior to version 8.4.0 are vulnerable to remote code execution (CVE-2026-23697, CVSS 8.7) via authenticated file upload through the Documents module; publicly available exploit…

Is there a public PoC exploit available for CVE-2026-23697?

Yes, a public proof-of-concept exploit is available for CVE-2026-23697. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-23697?

Within 24 hours: Inventory all Vtiger CRM instances and identify versions below 8.4.0; restrict access to the Documents module to administrative users only and require multi-factor authentication for all CRM users. Within 7 days: Implement centralized logging and monitoring for Documents module file uploads and authentication failures; test upgrade to Vtiger CRM 8.4.0 or later in a staging environment. Within 30 days: Complete upgrade of all production Vtiger CRM instances to version 8.4.0 or later and validate that .phar file uploads are properly blocked and PHP execution is disabled in the uploads directory.

Vtiger CRM CVE-2026-23697

Q: What is the CVSS score of CVE-2026-23697?

CVE-2026-23697 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-42055 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-07 VulnCheck

GHSA-3cpr-2h94-j6qj

PHP RCE Apache File Upload Vtiger Crm Vtiger

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Authenticated upload (PR:L) over the network with low complexity; scope changed (S:C) because a low-priv app account leads to unauthenticated OS-level code execution, with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 17:18 vuln.today

CVE Published

Jul 07, 2026 - 16:17 cve.org

HIGH 8.7

DescriptionCVE.org

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the .phar extension. The uploaded file is stored with its original .phar extension under the web-accessible storage directory, and a misconfigured .htaccess using Apache 2.2 syntax is silently ignored on Apache 2.4 deployments, allowing unauthenticated HTTP requests to directly execute the uploaded PHP payload.

AnalysisAI

Remote code execution in Vtiger CRM before 8.4.0 lets an authenticated low-privileged user upload a malicious .phar file through the Documents module and execute arbitrary PHP. The extension denylist in config.inc.php omits .phar, and a stale Apache 2.2-syntax .htaccess is silently ignored on Apache 2.4, so the payload lands in a web-accessible directory reachable by unauthenticated HTTP - the attack begins authenticated but the final execution step is unauthenticated. Publicly available exploit code exists (published by VulnCheck/Jiva Security); no CISA KEV listing and no EPSS score were provided.

Technical ContextAI

The flaw is a classic CWE-434 Unrestricted Upload of File with Dangerous Type, compounded by an Apache configuration regression. Vtiger CRM is an open-source PHP customer-relationship-management application (cpe:2.3:a:vtiger:vtiger_crm:*). Its Documents module enforces a blocklist of disallowed file extensions defined in config.inc.php, but that list omits .phar - PHP Archive files that the PHP interpreter will execute as ordinary PHP when routed through mod_php/php-fpm. The second half of the root cause is deployment drift: the storage directory ships an .htaccess written for Apache 2.2 (e.g. Order/Allow/Deny directives) which Apache 2.4 ignores unless mod_access_compat is loaded, so the intended 'deny script execution here' control is silently absent on modern servers.

RemediationAI

Upgrade to Vtiger CRM 8.4.0 or later, which is the first release that closes this issue (Vendor-released patch: 8.4.0). If you cannot upgrade immediately, add .phar (and other PHP-executable extensions such as .php, .php3, .php4, .php5, .phtml, .pht) to the upload extension denylist in config.inc.php so the Documents module rejects them at upload time. Independently, fix the web-server control so the storage directory cannot execute scripts: on Apache 2.4 either enable mod_access_compat or, better, rewrite the .htaccess using current syntax (Require all denied) and add 'php_admin_flag engine off' or a RemoveHandler/SetHandler directive to strip PHP execution in the storage path; trade-off is that any legitimate feature relying on script execution under that directory would also break, which is normally intended here. Restrict network access to the Documents/storage directory to further reduce exposure. Advisory URLs: https://www.vulncheck.com/advisories/vtiger-crm-authenticated-file-upload-rce-via-documents-module and https://www.vtiger.com/.