Arbitrary file upload in ChurchCRM - CVE-2026-58409
Published: July 20, 2026
Vulnerability identifier: #VU138411
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58409
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to unrestricted upload of files with dangerous types in ChurchCRM/Plugin/PluginInstaller.php and plugins/routes/api/management.php when installing a plugin ZIP archive from a URL. A remote privileged user can upload a crafted plugin archive containing a PHP file to execute arbitrary code.
The uploaded archive is extracted under the web root, and the PHP file can be executed via HTTP without enabling the plugin through the application interface.
Affected software
ChurchCRM
How to mitigate CVE-2026-58409
Install security update from vendor's website.
ChurchCRM - update to 7.4.0