CVE-2025-11939: churchcrm through 5.18.0 (inclusive); +1 more affected products

Affected technology

churchcrm · through 5.18.0 (inclusive)
churchcrm

ChurchCRM · 5.0, 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 5.7, 5.8, 5.9, 5.10, 5.11, 5.12, 5.13, 5.14, 5.15, 5.16, 5.17, 5.18.0
Vendor not specified by the source

Description’s affected range: up to 5.18.0

Component: Backup Restore Handler
File: src/ChurchCRM/Backup/RestoreJob.php

Attack conditions (VulDB, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 2.0/10) rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.