What is the CVSS score of EUVD-2026-19835?

EUVD-2026-19835 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by EUVD-2026-19835?

ChurchCRM versions before 7.1.0 contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary PHP code during setup, enabling complete server…. A patch is available.

How to fix or mitigate EUVD-2026-19835?

Within 24 hours: Identify all ChurchCRM installations and verify versions currently deployed; isolate any instances running versions prior to 7.1.0 from production if immediate patching is not feasible. Within 7 days: Upgrade all ChurchCRM instances to version 7.1.0 or later per vendor guidance. Within 30 days: Conduct forensic review of server logs and database access patterns for any installations that remained unpatched to identify potential exploitation; implement network segmentation to restrict setup wizard access if re-installation is required.

PHP EUVD-2026-19835

| CVE-2026-39337 CRITICAL

Code Injection (CWE-94)

2026-04-07 security-advisories@github.com

PHP Code Injection RCE

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:22 euvd

EUVD-2026-19835

Analysis Generated

Apr 07, 2026 - 18:22 vuln.today

CVE Published

Apr 07, 2026 - 18:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.

AnalysisAI

Remote code execution in ChurchCRM versions prior to 7.1.0 allows unauthenticated attackers to inject arbitrary PHP code through the unsanitized $dbPassword variable during setup wizard initialization, resulting in complete server compromise. This critical flaw (CVSS 10.0) exists as an incomplete fix for CVE-2025-62521 and requires no authentication or user interaction to exploit. The pre-authentication nature and maximum CVSS severity indicate immediate patching priority for all exposed ChurchCRM installations.

Technical ContextAI

ChurchCRM is an open-source church management system built on PHP. This vulnerability stems from CWE-94 (Improper Control of Generation of Code/'Code Injection'), specifically affecting the setup wizard's database configuration process. The $dbPassword parameter lacks input sanitization, allowing attackers to break out of the intended string context and inject arbitrary PHP code that executes server-side. This represents a classic PHP code injection vector where user-controlled data flows directly into dynamically evaluated or written code without proper escaping. The setup wizard executes with elevated privileges necessary for initial database configuration, amplifying the impact. As a regression of CVE-2025-62521, this demonstrates incomplete remediation of the original vulnerability class, where the fix failed to sanitize all user-controlled parameters in the installation workflow.

RemediationAI

Immediately upgrade all ChurchCRM installations to version 7.1.0 or later, which contains the complete fix for this code injection vulnerability. Organizations should verify that the setup wizard is disabled or inaccessible on production systems after initial configuration completes. For systems that cannot be immediately patched, implement network-level access controls to restrict setup wizard endpoints to trusted IP addresses only, or remove public internet access entirely until patching is complete. Review web server logs for suspicious POST requests to setup or installation endpoints containing unusual characters or PHP code patterns in database password fields to identify potential compromise. Consult the official security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pm2v-ggh4-mp7p for additional vendor guidance and indicators of compromise.