EUVD-2026-42054
GHSA-jf2j-jhvf-rc56
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable import feature (AV:N/AC:L) requires administrator rights (PR:H) and no interaction (UI:N); code execution on the same host yields full C/I/A impact with no scope change (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents directly into the modules/ directory under the web root without validating file types beyond the manifest.xml descriptor. Attackers can place executable PHP files in the modules/ directory that become directly accessible via HTTP, bypassing Vtiger's authentication and authorization layer entirely since Apache resolves the path and invokes the PHP interpreter before the application routing layer is involved, resulting in a persistent web shell independent of the originating session.
AnalysisAI
Authenticated remote code execution in Vtiger CRM through version 8.4.0 lets an administrator upload a crafted ZIP archive through the ModuleManager import feature and drop executable PHP files directly into the web-root modules/ directory, yielding a persistent web shell. Because Apache resolves and executes those PHP files before Vtiger's routing layer runs, the resulting shell bypasses the application's authentication entirely and survives independently of the attacker's login session. Publicly available exploit code exists (VulnCheck / Jiva Security), though there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Technical ContextAI
Vtiger CRM is a widely used open-source PHP CRM platform whose extensibility relies on a ModuleManager that imports add-on modules packaged as ZIP archives described by a manifest.xml descriptor. The flaw is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type): the import routine extracts archive contents straight into modules/ under the web root and validates only the manifest.xml descriptor rather than the file types of every extracted entry. Because the deployment runs PHP under Apache (typically mod_php or a PHP-FPM handler), any .php file landing in a web-accessible directory is treated as executable server-side code. The security boundary that normally gates Vtiger functionality - its login and ACL layer - is implemented in application code that only runs after routing, so a file that Apache maps directly to the PHP interpreter never reaches that boundary.
RemediationAI
No vendor-released patch version is identified in the available data, so upgrade guidance should be confirmed against the Vtiger vendor site (https://www.vtiger.com/) and the VulnCheck advisory (https://www.vulncheck.com/advisories/vtiger-crm-authenticated-rce-via-module-import-file-upload) for a fixed release above 8.4.0. Until a patched version is confirmed, apply compensating controls: restrict who holds Vtiger administrator accounts and enforce strong MFA on them since the exploit requires admin privileges; disable or restrict access to the ModuleManager/module import feature if the deployment does not need to install add-on modules, accepting the trade-off that legitimate module installation will require temporarily re-enabling it. At the web-server layer, configure Apache to refuse to execute PHP within the modules/ upload path (for example via a directory-scoped handler override such as php_admin_flag engine off or removing the PHP handler for that directory), understanding that this may break legitimate modules that expect to serve their own PHP endpoints and should be tested against installed extensions. Additionally, monitor the modules/ directory for newly written .php files and file-integrity changes to detect a dropped web shell.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today