ChurchCRM, an open-source church management system, contains a path traversal vulnerability (CWE-22) in its backup restore feature before version 6.5.3. The issue arises because the $rawUploadedFile['name'] parameter is user-controlled and not properly sanitized, allowing an authenticated administrator to upload files with arbitrary filenames to the /var/www/html/tmp_attach/ChurchCRMBackups/ directory. This can be exploited to overwrite Apache .htaccess configuration files, potentially leading to remote code execution. The vulnerability is addressed in ChurchCRM version 6.5.3.

An authenticated administrator can exploit this vulnerability to upload arbitrary files and overwrite Apache .htaccess files, resulting in remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, and no user interaction required beyond authentication.

This vulnerability is fixed in ChurchCRM version 6.5.3. Users should upgrade to version 6.5.3 or later to remediate this issue. No official patch link is provided, but upgrading to the fixed version is the recommended action. Since this is not a cloud service, remediation must be applied by the system administrators.