An authenticated user with permission to view file-attachments may be able to move/remove arbitrary files on the server.
Upgrade Note: This update constrains access to APIv4's File entity and the recently added option, move_file. The constraint parallels a similar constraint in APIv3's Attachment. To use the move_file option, you must invoke the API through a trusted channel (e.g. PHP-API) and set checkPermissions=>FALSE.
Some pop-up dialogs which include user-supplied titles may be vulnerable to cross-site scripting.
In the handling of Contact profile-images, there is a vulnerability to cross-site request forgery.
When submitting an invalid request, the request appears to be properly denied - but (in some cases) it still continues to execute.
This issue affects Drupal and Backdrop. It does not affect WordPress or Joomla. It may theoretically affect some versions of Standalone.
Consistent with our push over the past year to optimize CiviCRM brand awareness, we recently rebooted the monthly Community News email and began cross promotion of it and its individual items (blog posts, event announcements, etc.) on to other channels such as LinkedIn and Blue Sky.
We're bringing in the New Year by taking a break from the normal production of more CiviAcademy video tutorials in order to provide a light-hearted look at what may be equally important: what NOT to do in CiviCRM.
If you're new to CiviCRM or even considering using it, our Top 10 Most Common Mistakes Users Make in CiviCRM video showcase could prove to be an invaluable resource!
With the end-of-life, security updates for Drupal 7 will cease, leaving your CiviCRM website vulnerable to threats and potentially facing compatibility issues. It's crucial to understand your options and take action to ensure your site's security and functionality.
All is not lost! Organizations running CiviCRM on Drupal 7 still have viable options.
For 2025, the CiviCRM-D7 integration will continue to receive basic support, but usage is discouraged. Specifically:
CiviCRM generates *.pdf files with the assistance of a PDF engine. It is compatible with multiple engines, including the default DOMPDF and the alternative wkhtmltopdf. The latter option is now unsupported and insecure. Sites should remove it.
(Note: wkhtmltopdf is not distributed by CiviCRM. This is a public service announcement to alert people who may have installed wkhtmltopdf as an add-on.)
The bundled library "PhpSpreadsheet" has issued multiple security advisories.
