CVE-2026-23698 describes a vulnerability in Vtiger CRM up to version 8.4.0 where the ModuleManager import function in the admin module improperly validates uploaded zip archives. An attacker with administrator privileges can upload a crafted zip file containing arbitrary PHP files. These files are extracted directly into the modules/ directory under the web root, which is served by Apache. Because Apache executes PHP files before the application routing layer, the attacker can execute arbitrary code via a persistent web shell, bypassing Vtiger's authentication and authorization mechanisms.

The vulnerability allows authenticated administrators to achieve remote code execution by uploading malicious PHP files that become accessible and executable via HTTP. This results in a persistent web shell that does not require re-authentication, potentially leading to full system compromise. The CVSS 4.0 score is 8.6 (high severity), reflecting the network attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and avoid importing untrusted module packages. Monitor for suspicious files in the modules/ directory and consider implementing web server rules to block execution of unauthorized PHP files in that directory.