CVE-2025-68109: exploitation status and patch state

CVE-2025-68109 · CVSS 9.1 CRITICAL · EPSS 2%

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

Is CVE-2025-68109 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 2%.
• Public exploit code: packaged in a public tool.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2025-68109

• Metasploit Adds Public RCE Modules for Web Apps (2026-04-18)

Primary sources

• NVD record
• Metasploit: exploit/multi/http/churchcrm_db_restore_rce

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-14.