CVE-2025-68109

ChurchCRM vulnerable to RCE with database restore functionality

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

Affected

ChurchCRM · CRM

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GITHUB

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

1.53% chance of exploitation in the next 30 days, 74th percentile

Published

2025-12-17

Updated

2025-12-18

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/churchcrm_db_restore_…

Security advisories

• ChurchCRM/CRM/security/advisories/GHSA-pqm7-g8px-9r77

References

• CVE Record
• NVD entry