CVE-2025-11939
📋 TL;DR
This vulnerability in ChurchCRM allows attackers to perform path traversal attacks via the restoreFile parameter in the backup restore functionality. Remote attackers can potentially access or manipulate files outside the intended directory. All ChurchCRM installations up to version 5.18.0 are affected.
💻 Affected Systems
- ChurchCRM
📦 What is this software?
Churchcrm by Churchcrm
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution or sensitive file disclosure by accessing system files outside the web root
Likely Case
Unauthorized file read/write operations leading to data exposure or system compromise
If Mitigated
Limited impact if proper file permissions and input validation are in place
🎯 Exploit Status
Public exploit details available in GitHub advisory; vendor did not respond to disclosure
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor unresponsive
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version above 5.18.0 if released, or implement workarounds.
🔧 Temporary Workarounds
Disable Backup Restore Functionality
allRemove or restrict access to the vulnerable restore handler
# Remove or rename src/ChurchCRM/Backup/RestoreJob.php
# Add authentication/authorization checks to restore functionality
Implement Input Validation
allAdd path traversal checks to restoreFile parameter processing
# In RestoreJob.php, validate restoreFile parameter with realpath() and check if within allowed directory
# Example: if (strpos(realpath($restoreFile), '/allowed/path/') !== 0) { die('Invalid file'); }
🧯 If You Can't Patch
- Implement strict file system permissions to limit damage
- Use web application firewall (WAF) rules to block path traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check ChurchCRM version; if ≤5.18.0 and backup restore functionality is accessible, system is vulnerableCheck Version:
Check ChurchCRM admin interface or examine version files in installation directoryVerify Fix Applied:
Test path traversal attempts via restoreFile parameter; successful blocks indicate mitigation📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Requests to RestoreJob.php with suspicious file paths
Network Indicators:
- HTTP requests containing '../' or similar path traversal sequences
SIEM Query:
web.url:*RestoreJob.php* AND (web.url:*../* OR web.url:*..\*)