Vtiger CRM versions earlier than 8.4.0 allow a low‑privileged authenticated user to upload a .phar file that contains arbitrary PHP code through the Documentses the extension denylist defined in config.inc.php, storing the file with its original .phar extension in a web‑accessible directory. A misconfigured .htaccess, written for on Apache 2.4 servers; this silently permits unauthenticated HTTP requests that target the uploaded file to execute the embedded PHP payload, providing remote code execution even without authentication. The weakness is a classic file‑upload vulnerability (CWE‑434).

Vtiger CRM for all versions below 8.4.0. The issue is present in installations that have the Documents module enabled and which use the default config.inc.php denylist that excludes the .phar extension.

The CVSS score of 8.7 highlights high severity, and the EPSS score is less than 1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation yet. However, because the upload function is protected only by authentication, an attacker who gains any can upload a malicious .phar and, if the server runs Apache 2.4 with a legacy .htaccess, can later trigger execution from severity and the possibility of unauthenticated exploitation makes this a high‑risk vulnerability in environments where untrusted users may authenticate.