PT-2025-42716

CVE-2025-11939

Published

2025-10-19

Updated

2025-10-27

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 5.18.0

Description A path traversal issue exists in ChurchCRM due to improper handling of the restoreFile argument within the Backup Restore Handler component, specifically in the file src/ChurchCRM/Backup/RestoreJob.php. This allows for remote exploitation through manipulation of this argument. The vulnerability has been publicly disclosed.

Recommendations Update ChurchCRM to version 5.18.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Uartu0

Vuldb

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')