In ChurchCRM versions before 7.2.0, the database backup restore feature uses a recursive copy function that does not filter file extensions when copying files from the Images/ directory to the web root. This allows an authenticated administrator to upload a malicious backup archive containing a PHP webshell, which becomes publicly accessible and executable via HTTP, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF protection, enabling attackers to exploit this vulnerability via cross-site request forgery targeting authenticated administrators. The issue is tracked as CVE-2026-40484 and has a CVSS 3.1 score of 9.1 (critical). The vulnerability is fixed in ChurchCRM version 7.2.0.

Successful exploitation allows an authenticated administrator to achieve remote code execution on the web server, compromising confidentiality, integrity, and availability of the affected system. The lack of CSRF protection increases the attack surface by enabling attackers to trigger the restore functionality without direct interaction from the administrator. This can lead to full system compromise under the privileges of the web server user.

Upgrade ChurchCRM to version 7.2.0 or later, where this vulnerability is fixed. Until the upgrade is applied, restrict administrator access to trusted users only and avoid using the backup restore functionality with untrusted archives. Monitor for suspicious activity related to backup restores. Patch status is confirmed fixed in version 7.2.0.