CVE-2021-3164

HIGH 8.8CVE-2021-3164 · Published 26/01/2021 · updated 17/06/2026

In short

CVE-2021-3164 is a HIGH (CVSS 8.8) vulnerability affecting churchrota (churchdesk).
Chance of exploitation in the next 30 days (EPSS): 4.2%, higher than 90.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
churchrota churchdesk	`= 2.6.4`	No fix yet

Description

ChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permission in order to upload and execute an arbitrary file via a POST request to resources.php.

References

Little-Ben/ChurchRota · Third Party Advisory
rmccarth/cve-2021-3164 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free