{"id":"CVE-2025-68109","aliases":["EUVD-2025-203990","GHSA-pqm7-g8px-9r77"],"status":"published","title":"ChurchCRM vulnerable to RCE with database restore functionality","description":"ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01534,"percentile":0.7515,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434","CWE-494","CWE-552","CWE-78","CWE-915"],"published":"2025-12-17T21:29:39Z","modified":"2026-10-28T02:31:05Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/churchcrm_db_restore_rce","title":"ChurchCRM Database Restore RCE 6.2.0","type":"exploit","platform":"Linux,PHP","date":"2025-12-17","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/churchcrm_db_restore_rce"}],"products":[{"vendor":"churchcrm","product":"churchcrm"},{"vendor":"churchcrm","product":"crm"}],"references":[{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pqm7-g8px-9r77","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68109.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68109","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68109","title":"ChurchCRM vulnerable to RCE with database restore functionality","description":"ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.","status":"published","published":"2025-12-17T21:29:39.452Z","modified":"2025-12-18T15:08:39.365Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78","CWE-434","CWE-494","CWE-552","CWE-915"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-203990","description":"ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.","status":"published","published":"2025-12-17T21:29:39Z","modified":"2025-12-18T15:08:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:03.071772Z"}],"nvd":[{"id":"CVE-2025-68109","description":"ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.","status":"published","published":"2025-12-17T22:16:00.75Z","modified":"2026-10-01T16:10:00.257Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78","CWE-434","CWE-494","CWE-552","CWE-915"],"updated_at":"2026-11-02T14:11:51.309584Z"}],"osv":[{"id":"CVE-2025-68109","title":"ChurchCRM vulnerable to RCE with database restore functionality","description":"ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.","status":"published","published":"2025-12-17T21:29:39.452Z","modified":"2026-10-28T02:31:05.333515514Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434","CWE-494","CWE-552","CWE-78","CWE-915"],"updated_at":"2026-11-02T15:44:52.53036Z"}]}}