internet-facing-service-vulnerabilityinitial-access-method

Vtiger CRM File Upload Flaw Enables Remote Code Execution

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Jul 7, 2026

A high-severity vulnerability tracked as CVE-2026-23697 affects Vtiger CRM versions up to 8.3.0, allowing a low-privileged authenticated user to achieve remote code execution through the Documents module. The flaw stems from an incomplete extension denylist in config.inc.php that does not block .phar files, enabling an attacker to upload a malicious archive containing arbitrary PHP code. The issue is classified as CWE-434 and carries a CVSS v3.1 score vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jul 6, 2026 – Jul 7, 2026

Jul 7, 20264mo ago
CVE-2026-23697 advisory details Vtiger CRM file upload RCE
Advisories described an authenticated file upload vulnerability in Vtiger CRM versions up to 8.3.0 that lets a low-privileged user upload a malicious .phar file through the Documents module. Because .phar is omitted from the denylist and Apache 2.4 ignores the shipped Apache 2.2-style .htaccess, the uploaded payload can be executed via unauthenticated HTTP requests; Vtiger CRM 8.4.0 is listed as unaffected.
CVE-2026-23697 - Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module
Jul 6, 20264mo ago
Jiva Security publishes write-up on Vtiger CRM RCE chain
Jiva Security published a write-up describing a Vtiger CRM 8.3.0 remote code execution issue tracked as CVE-2026-23697 involving a .phar upload path.
Three Bugs, One Shell: Vtiger CRM 8.3.0 RCE (CVE-2026-23697) - Jiva Security

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Authenticated .phar File Upload RCE in Vtiger CRM Documents Module (CVE-2026-23697)

Affected products

1 linked

Vtiger Crm

Organizations

1 linked

Vtiger

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Vulncheck BlogNews · Jul 7, 2026

Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module | Advisories | VulnCheckOpen source ↗

Cvefeed High SeverityAdvisories · Jul 7, 2026

CVE-2026-23697 - Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents ModuleOpen source ↗

UnclassifiedNews · Jul 6, 2026

Three Bugs, One Shell: Vtiger CRM 8.3.0 RCE (CVE-2026-23697) - Jiva SecurityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Vtiger CRM File Upload Flaw Enables Remote Code Execution

How this story unfolded

CVE-2026-23697 advisory details Vtiger CRM file upload RCE

Jiva Security publishes write-up on Vtiger CRM RCE chain

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Authenticated File Upload Flaws Expose PhreeBooks ERP and phpBB to RCE

iCagenda Unrestricted File Upload Flaw Enabled Remote Code Execution

Dolibarr ERP/CRM Flaws Let Admins Trigger Remote Code Execution

Vtiger CRM File Upload Flaw Enables Remote Code Execution

How this story unfolded

CVE-2026-23697 advisory details Vtiger CRM file upload RCE

Jiva Security publishes write-up on Vtiger CRM RCE chain

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Authenticated File Upload Flaws Expose PhreeBooks ERP and phpBB to RCE

iCagenda Unrestricted File Upload Flaw Enabled Remote Code Execution

Dolibarr ERP/CRM Flaws Let Admins Trigger Remote Code Execution