CVE-2026-23697

Name of the Vulnerable Software and Affected Versions Vtiger CRM versions prior to 8.4.0

Description An authenticated file upload issue exists in the Documents module that allows low-privileged users to achieve remote code execution. This occurs because the extension denylist in config.inc.php omits the .phar extension, enabling the upload of files containing arbitrary PHP code. These files are stored with their original extension in a web-accessible directory. Furthermore, on Apache 2.4 deployments, a misconfigured .htaccess file using Apache 2.2 syntax is ignored, which allows unauthenticated HTTP requests to execute the uploaded PHP payload.

Recommendations Update Vtiger CRM to version 8.4.0 or later.