Vtiger CRM versions prior to 8.4.0 allow an authenticated low‑privileged user to upload a .phar file that carries arbitrary PHP code through the Documents module, circumventing the extension denylist defined in config.inc.php that presently omits the .phar extension. The uploaded file is stored in a web‑accessible directory with its original .phar extension, and a mis‑configured .htaccess file using Apache 2.2 syntax is silently ignored on Apache 2.4 deployments. This combination permits an attacker to retrieve the file with an unauthenticated HTTP request, causing the embedded PHP payload to execute and providing remote code execution.

All instances of Vtiger CRM whose software version is older than 8.4.0, the Documents module is enabled, and the default denylist in config.inc.php still excludes the .phar extension, are vulnerable. The flaw applies to any host that accepts authenticated uploads through the Documents module, regardless of whether the underlying web server is Apache 2.2 or 2.4.

The CVSS score of 8.7 classifies the issue as high severity, and the EPSS score of 1 % suggests a low but non‑zero probability of exploitation. Although the vulnerability is not listed in the CISA KEV catalog, the combination of authenticated upload capability and the possibility of unauthenticated execution in an Apache 2.4 environment makes it a high‑risk flaw. The attack path requires an attacker to log in with at least low privileges to upload a malicious .phar, followed by an unauthenticated HTTP request to trigger the payload.