CVE-2026-42288 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-42288 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-42288 is a critical pre-authentication remote code execution flaw in ChurchCRM affecting versions prior to 7.3.2. It is a follow-on to CVE-2026-39337, but the earlier fix was incomplete: the setup wizard still accepts an unsanitized DB_PASSWORD value, allowing an attacker to execute code before login. This is a CVSS 10 issue and should be treated as an immediate patch priority even though it is not currently known to be exploited in the wild and is not in CISA KEV.

If you run ChurchCRM for a small team, nonprofit, or community group, assume internet-facing instances are at risk until upgraded. The safest response is to upgrade to 7.3.2 or later immediately, or take the application offline until you can patch.

Immediate Action

  • Patch now: upgrade ChurchCRM to 7.3.2 or later. Do not leave any pre-7.3.2 instance exposed.
  • Isolate the service: if you cannot patch within minutes, restrict access to the setup wizard and place the app behind VPN, IP allowlisting, or a temporary maintenance page.
  • Rollback only if needed: if the upgrade breaks production, roll back to the last known-good backup only after removing public access and confirming the vulnerable setup flow is not reachable.
  • Rotate secrets: assume database credentials and any secrets handled during setup may be exposed. Rotate DB passwords and app secrets after patching.
  • Review vendor guidance: check the ChurchCRM release notes / security advisory for 7.3.2 and any hotfix instructions. Vendor advisory / release notes

Affected Versions

  • ChurchCRM < 7.3.2 vulnerable to pre-authentication RCE via the setup wizard.
  • ChurchCRM 7.3.2+ fixed.
  • TODO: any distro/package builds or container tags that bundle ChurchCRM < 7.3.2 are also vulnerable until rebuilt.

Resolution Guide

Preferred fix: upgrade ChurchCRM to the patched release. Use the method that matches your deployment.

# Docker / Compose: pin to a fixed tag (TODO: confirm official image tag naming)
docker pull churchcrm/churchcrm:7.3.2
docker stop churchcrm
docker rm churchcrm
docker run -d --name churchcrm -p 80:80 churchcrm/churchcrm:7.3.2

# Docker Compose example
services:
  churchcrm:
    image: churchcrm/churchcrm:7.3.2
    restart: unless-stopped

# Debian/Ubuntu (if installed from a package repo; TODO: confirm package name)
sudo apt update
sudo apt install --only-upgrade churchcrm

# RHEL/CentOS/Fedora (if packaged; TODO: confirm package name)
sudo yum update churchcrm
# or
sudo dnf update churchcrm

# If deployed from source, update the release checkout
git fetch --tags
git checkout v7.3.2
composer install --no-dev --optimize-autoloader

JavaScript / Python / Java ecosystems: ChurchCRM is not typically installed as an npm/pip/Maven dependency, so package-manager commands usually do not apply. If your deployment wraps ChurchCRM in a custom build pipeline, update the application source or container image rather than a library dependency.

Hardening while you patch:

# Block access to the setup wizard at the reverse proxy if possible
location /setup/ {
    deny all;
    return 403;
}

# Temporarily restrict access to trusted IPs only
allow 10.0.0.0/8;
allow 192.168.0.0/16;
deny all;

Minimal code-level mitigation idea if you maintain a fork: reject unsanitized database password input and avoid passing it into shell commands or dynamic config generation.

// Example mitigation pattern: validate and escape before use
$dbPassword = $_POST['DB_PASSWORD'] ?? '';
if (!is_string($dbPassword) || preg_match('/[\r\n`$;&|<>]/', $dbPassword)) {
    throw new RuntimeException('Invalid DB password format');
}
// Use parameterized APIs / safe escaping only

Detection & Verification

Check your version first. If the app is reachable, inspect the footer, admin page, release metadata, or deployment manifest. From the server:

# Source checkout
git describe --tags --always
git rev-parse --short HEAD

# Search for version markers
grep -RniE '7\.3\.[0-9]+' /var/www/churchcrm /opt/churchcrm 2>/dev/null

Look for exposed setup paths:

# Web server logs
grep -RniE '/setup|DB_PASSWORD|install' /var/log/nginx /var/log/apache2 2>/dev/null

Dependency and image checks:

# Docker image inspection
docker image inspect churchcrm/churchcrm:7.3.2 --format '{{.RepoTags}} {{.Id}}'

# If you use SBOM or scanning tools, confirm ChurchCRM >= 7.3.2
trivy image churchcrm/churchcrm:7.3.2
grype churchcrm/churchcrm:7.3.2

Verify the fix: confirm the running instance reports 7.3.2 or later, and that the setup wizard is no longer publicly reachable.

curl -I https://your-churchcrm.example/setup/
# Expect 403, 404, or a redirect to a safe page — not an active setup flow

Risk and Impact

This flaw can let an unauthenticated attacker run arbitrary code on the server before any login, which means full compromise of the ChurchCRM host is possible. In practice, that can expose member records, contact details, schedules, and any credentials stored on the system. Because the bug sits in the setup wizard, even a “fresh” or partially configured deployment can be vulnerable if the setup route is exposed. Treat the blast radius as the entire server and any connected database or file shares.

Keep reading