What is the CVSS score of CVE-2026-40484?

CVE-2026-40484 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-40484?

ChurchCRM versions prior to 7.2.0 contain a critical remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the database backup restore…

How to fix or mitigate CVE-2026-40484?

Within 24 hours: Identify all ChurchCRM instances and document current versions; restrict administrator access to non-essential personnel pending patch deployment. Within 7 days: Upgrade all ChurchCRM installations to version 7.2.0 or later (GitHub commit 68be1d12 or later). Within 30 days: Conduct forensic review of backup restore function logs for versions <7.2.0 to detect unauthorized file uploads; implement code review procedures for any custom backup extensions.

PHP CVE-2026-40484

CRITICAL

Improper Privilege Management (CWE-269)

2026-04-18 security-advisories@github.com

PHP Privilege Escalation CSRF RCE

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 18, 2026 - 00:38 vuln.today

Analysis Generated

Apr 18, 2026 - 00:22 vuln.today

CVE Published

Apr 18, 2026 - 00:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(), which performs no file extension filtering. An authenticated administrator can upload a crafted backup archive containing a PHP webshell inside the Images/ directory, which is then written to a publicly accessible path and executable via HTTP requests, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator. This issue has been fixed in version 7.2.0.

AnalysisAI

Remote code execution in ChurchCRM <7.2.0 allows authenticated administrators to upload PHP webshells through the database backup restore function, which copies files from archive Images/ directories to web-accessible paths without extension filtering. The vulnerability includes a CSRF bypass enabling forced exploitation through cross-site request forgery. Exploitation requires high privileges (administrator account) but is network-accessible with low complexity (CVSS:3.1/AV:N/AC:L/PR:H). No active exploitation confirmed (not in CISA KEV). Vendor-released fix available in version 7.2.0 via GitHub PR #8610 and commit 68be1d12.

Technical ContextAI

ChurchCRM is a PHP-based church management system providing database backup and restore capabilities. The vulnerability stems from the recursiveCopyDirectory() function used during backup restoration, which performs file copying operations from uploaded archives to the web server's document root without validating file extensions or MIME types. This represents CWE-269 (Improper Privilege Management) where administrative privileges are insufficient to prevent dangerous operations. The restore endpoint processes ZIP/archive files containing an Images/ directory structure, extracting and copying contents directly into publicly accessible web paths. The lack of CSRF token validation on the restore endpoint creates a second attack vector, allowing attackers to force exploitation through social engineering against authenticated administrators. PHP execution in the web document root enables direct code execution as the web server process user (typically www-data, apache, or nginx).

Affected ProductsAI

ChurchCRM versions prior to 7.2.0 are affected. The vulnerability exists in the database backup restore functionality accessible to authenticated administrators. Specific affected versions are not enumerated in available data, but all versions before the 7.2.0 release should be considered vulnerable. The fix is tracked in GitHub pull request #8610 and commit 68be1d12bc4cc1429575ae797ef05efe47030d39. Vendor advisory available at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-2932-77f9-62fx provides additional context.

RemediationAI

Upgrade to ChurchCRM version 7.2.0 or later, which implements file extension filtering in the recursiveCopyDirectory() function and adds CSRF token validation to the restore endpoint per GitHub PR #8610 (https://github.com/ChurchCRM/CRM/pull/8610). For environments unable to upgrade immediately, implement compensating controls: (1) Restrict administrator account access to trusted IP ranges via web server configuration or firewall rules - reduces exposure to credential compromise but impacts legitimate remote administration; (2) Block PHP execution in the web document root's Images/ directory and all upload paths using web server configuration (Apache: php_flag engine off in .htaccess; Nginx: location directive denying .php files) - prevents webshell execution but may break legitimate image processing if server-side PHP thumbnailing is used; (3) Implement file upload restrictions at the web application firewall or reverse proxy layer to reject archives containing .php, .phtml, .php5 files - may cause false positives if legitimate backups contain PHP configuration files. Review existing backup archives for suspicious PHP files in Images/ directories. Audit administrator account activity logs for unexpected restore operations.