CiviCRM Versions prior to 4.7.26 and 4.6.33
CiviCRM Version 4.7.26 and 4.6.33
As part of CiviCRM's defense in depth program, we have upgraded Smarty following an announcement by them that one of the functions in the Smarty templating engine potentially allowed for shell injection.
Despite this vulnerability in the Smarty library, CiviCRM's usage of Smarty appears to prevent such shell injection vulnerabilities.
Upgrade CiviCRM to the latest version
Or apply the following patch
- 4.7 - https://github.com/civicrm/civicrm-packages/pull/194/files
- 4.6 - https://github.com/civicrm/civicrm-packages/pull/195/files
Seamus Lee of Australian Greens for reporting and Fixing the issue