PT-2025-42716

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 5.18.0 Description A path traversal issue exists in ChurchCRM due to improper handling of the restoreFile argument within the Backup Restore Handler component, specifically in the file...

CVE-2025-11939: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in ChurchCRM up to 5.18.0. This issue affects some unknown processing of the file src/ChurchCRM/Backup/RestoreJob.php of the component Backup Restore Handler. Executing a manipulation of the argument restoreFile can lead to path traversal. The attack may be launched...