Loading story…
A high-severity vulnerability tracked as CVE-2026-23697 affects Vtiger CRM versions up to 8.3.0, allowing a low-privileged authenticated user to achieve remote code execution through the Documents module. The flaw stems from an incomplete extension denylist in config.inc.php that does not block .phar files, enabling an attacker to upload a malicious archive containing arbitrary PHP code. The issue is classified as CWE-434 and carries a CVSS v3.1 score vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Advisories described an authenticated file upload vulnerability in Vtiger CRM versions up to 8.3.0 that lets a low-privileged user upload a malicious .phar file through the Documents module. Because .phar is omitted from the denylist and Apache 2.4 ignores the shipped Apache 2.2-style .htaccess, the uploaded payload can be executed via unauthenticated HTTP requests; Vtiger CRM 8.4.0 is listed as unaffected.
Jiva Security published a write-up describing a Vtiger CRM 8.3.0 remote code execution issue tracked as CVE-2026-23697 involving a .phar upload path.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
vulncheck.com
Open sourcecvefeed.io
Open sourcejivasecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
High-severity vulnerabilities have been disclosed for **PhreeBooks ERP 5.2.3** and **phpBB**, both allowing authenticated attackers to turn file upload functionality into remote code execution. In **CVE-2019-25630**, an attacker can abuse the `imgFile` parameter in the `bizuno/image/manager` endpoint to upload a malicious PHP file and then execute it through `bizunoFS.php`. The issue affects the Image Manager component in PhreeBooks ERP and was rated high impact under both CVSS v3.1 and v4.0. A separate flaw, **CVE-2019-25685**, affects phpBB and uses `plupload` together with the `phar://` stream wrapper to upload a crafted ZIP archive containing serialized PHP objects. When those objects are later deserialized via the `imagick` parameter in attachment settings, arbitrary code can be executed on the server. References tied to the disclosures include **Exploit-DB** and **VulnCheck**, indicating public technical detail is available for both upload-to-RCE attack paths.
Jun 29, 2026
A **zero-day vulnerability** in the Joomla extension **iCagenda** allowed attackers to upload arbitrary files and achieve **remote code execution (RCE)**, and the issue was addressed in version **4.0.8**. The flaw fit the well-known pattern of **unrestricted file upload**, where weak validation of uploaded content lets an attacker place executable or otherwise dangerous files on a target server. OWASP guidance on unrestricted file upload shows how such weaknesses can be exploited through manipulated filenames, extensions, content types, parser behavior, and downstream file processing, leading to outcomes including **server compromise, denial of service, phishing, malware hosting, defacement, and information disclosure**. Recommended mitigations include strict allow lists, randomized filenames, storing uploads outside executable paths, enforcing size and authorization controls, scanning uploads, and applying secure response headers to reduce the risk of similar upload-to-RCE attacks.
Jul 18, 2026
Two high-severity vulnerabilities in **Dolibarr ERP/CRM** allow authenticated administrators to achieve remote code execution through separate application paths. `CVE-2026-22666` affects versions before **23.0.2** and stems from the `dol_eval_standard()` function, which can be abused through computed extrafields and other evaluation paths because forbidden string checks are not properly enforced in whitelist mode and PHP dynamic callable syntax is not detected. The flaw enables arbitrary command execution via `eval()` and is classified as **CWE-95**. A second issue, `CVE-2026-23500`, affects versions before **23.0.0** and exposes an OS command injection bug in the ODT-to-PDF conversion workflow in `odf.php`. The `MAIN_ODT_AS_PDF` configuration constant is concatenated into a shell command passed to `exec()` without sanitization, allowing an authenticated administrator to inject shell separators and run arbitrary commands as the web server user when generating an ODT template. The vulnerabilities were addressed in **Dolibarr 23.0.0** and **23.0.2**, underscoring the need for organizations running Dolibarr to upgrade promptly.
Jun 29, 2026