CVE-2026-23698: Vtiger CRM through 8.4.0 allows authenticated admin users to achieve remote code execution by uploading a crafted module ZIP that places PHP files in the web-accessible modules/ directory.
CVE-2026-23698 is verified against Vtiger CRM · other affected versions: through 8.4.0 vulnerability class: RCE This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00273.
pruva-verify REPRO-2026-00273 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00273/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Vtiger CRM through 8.4.0 contains an authenticated remote code execution (RCE) flaw in the admin Module Manager import feature. A crafted module ZIP can place arbitrary PHP files into the web root (modules/), which are then directly reachable via HTTP, bypassing application routing and authentication.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.