The vulnerability allows an authenticated administrator to upload a crafted zip archive through VtManager import feature, which extracts files directly into the web‑root modules/ directory without validating file types beyond the manifest.xml descriptor. By including arbitrary PHP files in the archive, an attacker can place executable code that becomes reachable via HTTP, a classic instance of CWE‑434 ( web server serves these files before Vtiger’s routing and access controls, the attacker bypasses all authentication and authorization checks, resulting in persistent remote code execution.

This vulnerability affects the Vtiger CRM application from Vtiger:Vtiger CRM, specifically all releases up to and including version 8.4.0. No missing version information is provided; the description indicates that 8.4.0Vtiger CRM versions up to 8.4.0 include an authenticated remote code execution flaw. Administrators can validating file types beyond the manifest.xml descriptor. Once uploaded, these PHP files are served directly by Apache, bypassing Vtiger’s authentication and routing layers, which creates a persistent web shell that can be accessed via HTTP without any prior session. The attacker can run arbitrary code, exfiltrate data, and maintain access across sessions.

The CVSS score of 8.6 indicates a high severity of the flaw. The EPSS score is < 1%, indicating a very low probability of exploitation in the wild. Attackers could easily abuse the flaw to achieve code execution, data theft, or persistence. The lack of file type checks and direct PHP execution in the modules directory makes the attack path straightforward for a privileged attacker.