CVE-2025-62521 is a critical (CVSS 10.0) pre-authentication code injection flaw (CWE-94) in the ChurchCRM setup wizard. Versions before 5.21.0 let an unauthenticated visitor write PHP into the config file. The fix is ChurchCRM 5.21.0. Upgrade and check Include/Config.php.
What's affected
The NVD record says ChurchCRM versions prior to 5.21.0 are affected, and that 5.21.0 patches the issue. The GitHub advisory (GHSA-m8jq-j3p9-2xf3) carries the title "Unauthenticated RCE in Install Wizard, 5.18.0 and earlier" and states that all versions that include the vulnerable setup process are affected. The two version statements do not match, so treat anything below 5.21.0 as affected.
The weakness sits in setup/routes/setup.php. The CVSS vector is network reachable, low complexity, no privileges and no user interaction, with the highest impact on confidentiality, integrity and availability.
How to check if you're exposed
Find your ChurchCRM version in the admin interface (the system information or footer shows it) and compare it with 5.21.0. For a Composer or Git based install, check the project version in your deployment.
Next, check whether the setup wizard is still reachable. A finished installation should not expose it. From your own workstation, make a plain request to the setup path on your own server and see whether you get the wizard or an error:
curl -s -o /dev/null -w "%{http_code}\n" https://your-crm.example/setup/
Finally, open Include/Config.php and read it. It should contain only your database settings and URL values. Any unexpected PHP statements, function calls or code after a value is a sign of tampering. Compare it with a known good backup if you have one, and review web server logs for requests to the setup path that you did not make.
What to do now
- Upgrade ChurchCRM to 5.21.0 or later.
- Open
Include/Config.phpand confirm it holds only expected configuration values. Restore from a clean backup if anything looks wrong. - Block or remove access to the
setuppath on any installation that is already configured. - Review web server logs for requests to the setup path, and treat unexplained ones as a possible compromise.
- If you find tampering, rotate the database password and any credentials stored on the server, and rebuild the host from a trusted image.
Why it matters
The wizard collects database and URL values, then drops them into a PHP configuration template and writes the result to a file the application runs on every page load. According to the advisory, the values were placed into the template without validation. Anything a visitor typed into the form could therefore become code. That is CWE-94: code built from untrusted input.
What makes this worse than a typical authenticated bug is the timing. The setup route needed no login, and administrators must run it during installation, so any server exposed before it is finished, or one that keeps the route reachable afterwards, is in range.
The record does not mark this CVE as CISA Known Exploited. I found no claim of exploitation in the advisory.
Try it yourself
Input flowing into a file that later executes is the kind of pattern static analysis is built to flag.
Click through it at your own pace, or open it full screen.
Quick check
My ChurchCRM is already set up. Am I safe?
Not automatically. The record says versions before 5.21.0 are affected, and the advisory does not describe the setup route being switched off after installation. Upgrade, and make sure the setup path is not reachable.
What is the safest way to write config values from user input?
Never build code from input. Store settings in a data format that is parsed rather than executed, validate every value against a strict pattern, and escape on output for the context it lands in.
Sources
Last reviewed: 18 October 2026.
