What is the CVSS score of CVE-2026-35573?

CVE-2026-35573 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-35573?

ChurchCRM versions before 6.5.3 contain a critical remote code execution vulnerability in the backup restore feature that allows authenticated administrators to upload malicious files and execute…. A patch is available.

How to fix or mitigate CVE-2026-35573?

Within 24 hours: Identify all ChurchCRM instances in your environment and confirm current versions. Within 7 days: Apply ChurchCRM vendor patch to version 6.5.3 or later on all affected systems. Within 30 days: Audit admin account activity logs in ChurchCRM for suspicious backup restore operations and review file upload patterns for the past 90 days; conduct access review of high-privilege ChurchCRM admin roles and revoke unnecessary administrative permissions.

PHP CVE-2026-35573

EUVD-2026-19771 CRITICAL

Path Traversal (CWE-22)

2026-04-07 GitHub_M

RCE PHP Path Traversal Apache

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.5.3

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19771

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:06 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.

AnalysisAI

Remote code execution in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to upload malicious files via path traversal in the backup restore functionality, overwriting Apache .htaccess files to execute arbitrary code. The vulnerability exploits unsanitized user input in RestoreJob.php, enabling attackers with high-privilege access to bypass intended upload restrictions. No public exploit identified at time of analysis, though CVSS 9.1 reflects the critical impact of complete system compromise through changed security scope.

Technical ContextAI

The vulnerability resides in ChurchCRM's RestoreJob.php backup restoration module, specifically in the handling of the $rawUploadedFile['name'] parameter during file upload operations to /var/www/html/tmp_attach/ChurchCRMBackups/. This is a classic CWE-22 path traversal flaw where insufficient input validation allows directory traversal sequences (../) in filenames. The affected product (cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*) is a PHP-based church management system running on Apache web servers. By controlling the filename parameter, attackers can escape the intended upload directory and write files to arbitrary locations within the web server's document root. The specific attack technique involves uploading crafted .htaccess files that reconfigure Apache's security directives, enabling execution of uploaded PHP code that would normally be restricted. The PHP file handling functions fail to canonicalize paths or validate that the final resolved path remains within authorized boundaries before writing uploaded content.

RemediationAI

Upgrade immediately to ChurchCRM version 6.5.3 or later, which contains fixes for the path traversal vulnerability in the backup restore functionality. The vendor-released patch addresses the unsanitized filename handling in src/ChurchCRM/Backup/RestoreJob.php by implementing proper input validation and path canonicalization. Organizations should obtain the patched version from the official ChurchCRM GitHub repository. As interim mitigation for environments where immediate patching is not feasible, restrict administrator account access through network segmentation, implement strict administrator credential policies, enable comprehensive logging of backup restore operations, and consider temporarily disabling the backup restore functionality if not operationally required. Review Apache access logs for suspicious .htaccess file creation in the tmp_attach/ChurchCRMBackups/ directory or elsewhere in the web root as potential indicators of exploitation attempts. Full remediation guidance and patch details are available in the GitHub Security Advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx.