In CiviMail, multiple fields and screens could be used as vectors for cross-site scripting.

Exploiting this requires that the attacker have permission to manage CiviMail content.

The Extension Download API provides administrators with tools for installing and sideloading extensions. The API is available in PHP, HTTP, CLI, etc. To execute the API, both the POSIX process and the CiviCRM user must have certain permissions.

The issue here is not a specific vulnerability in the API; on its own, it respects ordinary permissioning. However, if the system has another vulnerability (such as XSS), then the Extension Download API is an appealing target for escalation.

On the "Find Participants" search, the participant status field was not properly escaped.

With multiple entry-points in APIv3, there was an ability to move arbitrary files from the server filesystem.

When viewing a contact or viewing the manage tags screen, the tag name and tag set names were not properly escaped.

In the File API, there was inscufficent validation of the uri field to prevent path transversal. This is a follow up to CIVI-SA-2026-01

The price field label was not properly escaped for select price fields.