dbcve.org
Unrestricted File UploadWeakness · CWE-434

CVE-2026-23698

HIGH · 7.2 CVSS v3.1 Published 2026-07-07
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
78/100
Remediation priority · High
Remotely reachable Zero-click 7 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents directly into the modules/ directory under the web root without validating file types beyond the manifest.xml descriptor. Attackers can place executable PHP files in the modules/ directory that become directly accessible via HTTP, bypassing Vtiger's authentication and authorization layer entirely since Apache resolves the path and invokes the PHP interpreter before the application routing layer is involved, resulting in a persistent web shell independent of the originating session.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Vtiger CRM 8.4.0 and prior allows authenticated administrators to import modules via a zip archive through the ModuleManager. The import function extracts archive contents directly into the web-root modules/ directory without validating file types beyond manifest.xml. Attackers can embed executable PHP files in the zip that become directly accessible via HTTP, bypassing Vtiger's application-level authentication since Apache executes the PHP before the application routing layer is invoked, creating a persistent web shell.

MitigationRestrict or disable the ModuleManager import feature for untrusted users; implement strict validation to reject archives containing executable files outside expected paths; move the modules/ directory outside the web root or configure web server rules to deny direct PHP execution in that directory; apply vendor patch when available.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm Vtiger CRM installation and version
    Locate the version.php file in the vtiger root directory (commonly at vtiger/vtigerversion.php or similar path depending on installation) and read the $vtiger_version variable. Alternatively, check the admin dashboard System Info or About page.
    Affected if The installed version is 8.4.0 or any version prior to 8.4.0.
  2. Verify ModuleManager import feature is accessible
    Log in as an administrator and navigate to Settings > Module Manager or access the endpoint typically at /index.php?module=ModuleManager&view=Index. Check if the Import option exists and is enabled.
    Affected if The authenticated administrator user can access and use the ModuleManager import function.
  3. Inspect modules/ directory for unexpected PHP files
    List all files in the web-root modules/ directory (e.g., ls -la /var/www/html/vtiger/modules/ or via FTP/file manager). Look for any .php files that were not intentionally installed as part of known modules.
    Affected if Any .php files exist in modules/ that are not part of the officialVtiger module distribution.
  4. Confirm modules/ directory is web-accessible
    Check the web server configuration (Apache httpd.conf or vhost file) for the document root. Verify that the modules/ directory is located within the web root and is not blocked from HTTP access via Deny/Require directives.
    Affected if The modules/ directory resides within the web document root and is accessible via HTTP.
  5. Check for direct PHP execution in modules/ directory
    Review Apache configuration for php_admin_value, php_flag, or <FilesMatch> directives that apply to the modules/ directory. Attempt to access a known PHP file in modules/ via curl or browser to verify it executes.
    Affected if PHP files in modules/ are executed by the web server rather than being served as plain text or blocked.

A user is affected if they run Vtiger CRM version 8.4.0 or prior, have administrator access to the ModuleManager import feature, and the modules/ directory is web-accessible with PHP execution enabled, especially if unauthorized PHP files are present in that directory.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Restrict or disable the ModuleManager import feature for untrusted users; implement strict validation to reject archives containing executable files outside expected paths; move the modules/ directory outside the web root or configure web server rules to deny direct PHP execution in that directory; apply vendor patch when available.

Recommended fix Moderate confidence

Latest stable Vtiger CRM release (contact vendor for specific version number)

  1. 1. Identify the current Vtiger CRM version by checking the vtiger_version file in the application root directory
  2. 2. Navigate to the official Vtiger CRM website (www.vtiger.com) or contact Vtiger support to confirm the availability of a security patch or newer stable release
  3. 3. Before applying any update, perform a complete backup of the Vtiger CRM database, file system, and configuration
  4. 4. Test the upgrade in a non-production environment to verify compatibility with existing customizations and integrations
  5. 5. Apply the security update or upgrade to the latest stable version that addresses the unrestricted file upload vulnerability
  6. 6. After upgrading, verify that the ModuleManager import function properly validates file types and does not allow PHP file placement in the modules/ directory
  7. 7. Review web server access logs for any signs of exploitation attempts targeting the modules/ directory
  8. 8. If immediate upgrade is not possible, restrict administrative access to trusted IPs only and monitor for unauthorized PHP files in the modules/ directory
Caveat Upgrading Vtiger CRM may introduce breaking changes to custom modules, workflows, or integrations; thorough testing in staging is recommended

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation3.0 h
  • Implementation6.0 h
  • Testing3.0 h
  • Review / QA2.0 h
14.0 hours of engineering $2,490
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-23698 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-23698 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data