NETivism · Chen-LiYin · Aug 6, 2026 · Aug 6, 2026 · Aug 6, 2026 · Aug 6, 2026
diff --git a/CRM/Contact/BAO/GroupContact.php b/CRM/Contact/BAO/GroupContact.php
@@ -694,6 +694,11 @@ public static function bulkAddContactsToGroup(
     $tracking = NULL
   ) {
 
+    $contactIDs = array_map('intval', $contactIDs);
+    $groupID = (int) $groupID;
+    $method = CRM_Core_DAO::escapeString($method);
+    $status = CRM_Core_DAO::escapeString($status);
+    $tracking = CRM_Core_DAO::escapeString($tracking ?: '');
     $numContactsAdded = 0;
     $numContactsNotAdded = 0;
 

diff --git a/CRM/Core/BAO/File.php b/CRM/Core/BAO/File.php
@@ -161,6 +161,14 @@ public static function filePostProcess(
 
     $config = &CRM_Core_Config::singleton();
 
+    // Security: validate file path is within CiviCRM upload directory (security/core#173)
+    $realData = realpath($data);
+    $uploadDir = realpath($config->uploadDir);
+    if (!$realData || !$uploadDir || strpos($realData, $uploadDir . DIRECTORY_SEPARATOR) !== 0) {
+      CRM_Core_Error::fatal(ts('Security: File path is not within the allowed upload directory'));
+      return;
+    }
+
     $path = explode('/', $data);
     $filename = $path[count($path) - 1];
 

diff --git a/CRM/Core/Page/File.php b/CRM/Core/Page/File.php
@@ -67,6 +67,12 @@ public function run() {
       CRM_Core_Error::fatal('Could not retrieve the file');
     }
 
+    if (empty($downloadName) && substr($path, -8) === '.unknown') {
+      $mimeType = 'application/octet-stream';
+      header('Content-Security-Policy: default-src \'none\'');
+      header('X-Content-Type-Options: nosniff');
+    }
+
     $buffer = file_get_contents($path);
     if ($buffer === FALSE) {
       CRM_Core_Error::fatal('The file is either empty or you do not have permission to retrieve the file');

diff --git a/api/v3/Extension.php b/api/v3/Extension.php
diff --git a/api/v3/File.php b/api/v3/File.php
@@ -61,6 +61,13 @@ function civicrm_api3_file_create($params) {
 
   civicrm_api3_verify_mandatory($params, 'CRM_Core_DAO_File', ['uri']);
 
+  // Security: Validate URI to prevent path traversal attacks
+  if (isset($params['uri']) && $params['uri'] !== basename($params['uri'])) {
+    throw new CRM_Core_Exception(
+      'Invalid URI: must not contain directory separators or path traversal sequences'
+    );
+  }
+
   if (!isset($params['upload_date'])) {
     $params['upload_date'] = date("Ymd");
   }

diff --git a/templates/CRM/Admin/Page/EventTemplate.tpl b/templates/CRM/Admin/Page/EventTemplate.tpl
@@ -55,9 +55,9 @@
         </thead>
         {foreach from=$rows item=row}
           <tr id='rowid{$row.id}' class="{cycle values="odd-row,even-row"} crm-event crm-event_{$row.id}">
-              <td class="crm-event-template_title">{$row.template_title}</td>	
-              <td class="crm-event-event_type">{$row.event_type}</td>	
-              <td class="crm-event-participant_role">{$row.participant_role}</td>	
+              <td class="crm-event-template_title">{$row.template_title|escape}</td>	
+              <td class="crm-event-event_type">{$row.event_type|escape}</td>	
+              <td class="crm-event-participant_role">{$row.participant_role|escape}</td>	
               <td class="crm-event-participant_listing">{$row.participant_listing}</td>	
               <td class="crm-event-is_public">{if $row.is_public eq 1}{ts}Yes{/ts} {else} {ts}No{/ts} {/if}</td>
               <td class="crm-event-is_monetary">{if $row.is_monetary eq 1}{ts}Yes{/ts} {else} {ts}No{/ts} {/if}</td>

diff --git a/templates/CRM/Contact/Page/View/CustomDataFieldView.tpl b/templates/CRM/Contact/Page/View/CustomDataFieldView.tpl
@@ -38,7 +38,7 @@
           {if $element.field_value.image}
               <td class="crm-custom_data crm-displayURL">{include file='CRM/common/modal.tpl' modalImage=$element.field_value.image}</td>
           {else}
-              <td class="html-adjust crm-custom_data crm-fileURL"><a href="{$element.field_value.fileURL}">{$element.field_value.fileName}</a></td>
+              <td class="html-adjust crm-custom_data crm-fileURL"><a href="{$element.field_value.fileURL}">{$element.field_value.fileName|escape}</a></td>
           {/if}
       {elseif $element.field_data_type EQ 'ContactReference' && $element.contact_ref_id}
           {*Contact ref id passed if user has sufficient permissions - so make a link.*}

diff --git a/templates/CRM/Contact/Page/View/Summary.tpl b/templates/CRM/Contact/Page/View/Summary.tpl
@@ -204,8 +204,8 @@
                                 {foreach from=$website item=item}
                                     {if $item.url}
                                     <tr>
-                                        <td class="label">{$item.website_type} {ts}Website{/ts}</td>
-                                        <td><a href="{$item.url}" target="_blank">{$item.url}</a></td>
+                                        <td class="label">{$item.website_type|escape} {ts}Website{/ts}</td>
+                                        <td><a href="{$item.url|escape}" target="_blank">{$item.url|escape}</a></td>
                                         <td></td>
                                     </tr>
                                     {/if}

diff --git a/templates/CRM/Custom/Page/CustomDataView.tpl b/templates/CRM/Custom/Page/CustomDataView.tpl
@@ -72,7 +72,7 @@
 					    {if $element.field_value.image}
 						<td class="html-adjust">{include file='CRM/common/modal.tpl' modalImage=$element.field_value.image}</td>
 					    {else}
-						<td class="html-adjust"><a href="{$element.field_value.fileURL}">{$element.field_value.fileName}</a></td>
+						<td class="html-adjust"><a href="{$element.field_value.fileURL}">{$element.field_value.fileName|escape}</a></td>
 					    {/if}
 					{else}
 					    <td class="html-adjust">{$element.field_value|escape}</td>

diff --git a/templates/CRM/Event/Form/Selector.tpl b/templates/CRM/Event/Form/Selector.tpl
@@ -110,7 +110,7 @@
     </td>
     <td class="crm-participant-participant_register_date">{$row.participant_register_date|crmDate}</td>	
     <td class="crm-participant-participant_status crm-participant_status_{$row.participant_status_id}">{$row.participant_status}</td>
-    <td class="crm-participant-participant_role">{$row.participant_role_id}</td>
+    <td class="crm-participant-participant_role">{$row.participant_role_id|escape}</td>
     <td class="row-action">{$row.action|replace:'xx':$participant_id}</td>
    </tr>
   {/foreach}

diff --git a/templates/CRM/Event/Page/ManageEvent.tpl b/templates/CRM/Event/Page/ManageEvent.tpl
@@ -61,7 +61,7 @@
         {foreach from=$rows item=row}
           <tr id="row_{$row.id}" class="{cycle values="odd-row,even-row"} {$row.class}{if NOT $row.is_active} disabled{/if}">
             <td>{$row.id}</td>
-            <td class="crm-event-type">{$row.event_type}</td>
+            <td class="crm-event-type">{$row.event_type|escape}</td>
             <td class="crm-event-title crm-event_{$row.id}">
               <a href="{crmURL p='civicrm/event/search' q="reset=1&force=1&event=`$row.id`"}" class="bold">{$row.title|smarty:nodefaults|purify}</a>
               <ul class="crm-nav-menu crm-nav-links-event">