CVE-2026-35573

OVERVIEW CVE-2026-35573 is a path traversal vulnerability affecting ChurchCRM, an open-source church management system, in versions prior to 6.5.3. The flaw resides in the backup restore functionality within RestoreJob.php, where the user-controlled $rawUploadedFile['name'] parameter fails to properly validate uploaded file names, enabling authenticated administrators to upload arbitrary files to unintended directories. SEVERITY The vulnerability carries a CVSS 3.1 score of 9.1 (Critical) with a network-based attack vector requiring high privilege authentication but no user interaction. The impact is severe, affecting confidentiality, integrity, and availability across the system scope. Exploitation allows authenticated administrators to overwrite Apache .htaccess configuration files, leading to remote code execution and complete system compromise. EXPLOITATION STATUS Currently, the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. EPSS scoring indicates relatively low prevalence compared to other CVEs, and the vulnerability remains on the inactive hot list. However, given the critical severity rating and straightforward exploitation mechanism, patches should be prioritized for all ChurchCRM installations running versions prior to 6.5.3.