Executive brief
Vtiger CRM is a platform used by businesses to manage customer relationships, sales, and support operations. A security flaw allows a user with even low-level access to upload a malicious file to the server. Once uploaded, this file can be used to take complete control of the system, potentially leading to the theft of customer data, access to database credentials, and a total disruption of business operations.
Technical details
Vtiger CRM (versions prior to 8.4.0) suffers from an unrestricted file upload vulnerability (CWE-434) in the Documents module. The root cause is a blacklist-based extension filter in 'config.inc.php' that omits the '.phar' extension, which PHP executes as code. While the application attempts to restrict access to the upload directory via a '.htaccess' file, it uses deprecated Apache 2.2 syntax ('Order Deny,Allow') which is silently ignored by Apache 2.4 deployments without 'mod_access_compat'. An authenticated attacker with low-level 'Documents' access can upload a malicious .phar payload and execute it via a direct HTTP request to the web-accessible storage directory, resulting in full remote code execution. This is further facilitated by directory listing being enabled in some deployments, allowing attackers to easily locate the uploaded file.
Affected products
- Vtiger Vtiger CRM before 8.4.0
Timeline
- 2026-07-07: disclosed
- 2026-07-07: advisory
- 2026-07-07: patched: Fixed in version 8.4.0