CIVI-SA-2026-16: Path Traversal in Contact Importer

Opublikowane
2026-03-18 12:00
Written by
Security Risk
Less Critical
Vulnerability
Other
Affected Versions

CiviCRM v6.12.0 and earlier

Fixed Versions

CiviCRM v6.12.1, v6.10.3 (ESR), and later

Publication Date
Solutions

Any ONE of the following will mitigate the vulnerability:

  • Upgrade to a fixed version of CiviCRM, or...
  • Restrict permission import contacts to administrators
Credits

Lassi (lassitemp@proton.me), Seamus Lee (JMA Consulting), Coleman Watts (CiviCRM)