Loading vulnerability…
Authenticated .phar File Upload RCE in Vtiger CRM Documents Module
CVE-2026-23697 is an authenticated unrestricted file upload vulnerability in Vtiger CRM affecting versions before 8.4.0. A low-privileged authenticated user can upload a .phar file containing arbitrary PHP code through the Documents module because the application's extension denylist in config.inc.php omits the .phar extension. The uploaded file is preserved with its original .phar extension and stored in a web-accessible storage directory. On Apache 2.4 deployments, the intended access restrictions are ineffective because the accompanying .htaccess uses Apache 2.2 syntax and is silently ignored, allowing direct HTTP access to the uploaded payload. Successful exploitation results in remote code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged authenticated user to achieve remote code execution on the underlying server. Because the malicious upload is placed in a web-accessible location and Apache 2.4 may ignore the intended .htaccess protections, the uploaded payload can be triggered through direct unauthenticated HTTP requests after upload. This can lead to full compromise of application confidentiality, integrity, and availability, including arbitrary command execution, data theft, application tampering, and service disruption.
If you can’t patch tonight, do this now.
Until patching is completed, restrict or disable uploads through the Documents module for untrusted users, explicitly deny .phar and other executable upload types, and prevent execution of files from upload and storage directories. Remove web access to uploaded content where possible, or serve it from non-executable storage outside the document root. Review and fix Apache configuration to use Apache 2.4-compatible access controls rather than legacy .htaccess syntax.
Patch, then assume compromise.
Upgrade Vtiger CRM to version 8.4.0 or later. Ensure the application blocks upload of executable file types, including .phar, and review server-side validation so disallowed extensions cannot bypass filtering. Correct the web server access-control configuration so protections are valid for Apache 2.4 and prevent execution of user-uploaded content from storage locations.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.