ChurchCRM, an open-source church management system, contains a path traversal vulnerability in its backup restore feature before version 6.5.3. The vulnerability arises from insufficient validation of the user-controlled filename parameter ($rawUploadedFile['name']) in src/ChurchCRM/Backup/RestoreJob.php, allowing authenticated administrators to upload files with arbitrary names to the /var/www/html/tmp_attach/ChurchCRMBackups/ directory. This can lead to overwriting critical Apache .htaccess configuration files, enabling remote code execution. The vulnerability is addressed in ChurchCRM version 6.5.3.

Successful exploitation allows authenticated administrators to upload arbitrary files with crafted filenames, leading to overwriting of Apache .htaccess files. This can result in remote code execution, complete compromise of the web server hosting ChurchCRM, and full control over the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system.

Upgrade ChurchCRM to version 6.5.3 or later, where this vulnerability is fixed. Since the vulnerability requires authenticated administrator access, ensure that administrator credentials are protected and access is limited. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 6.5.3. No other mitigations are documented.