posted one day ago
•
Show version history
There were 2 major vulnerabilities in this week's news. As we started getting some questions, this is where Laserfiche stands.
- PHP CVE-2026-109618 and CVE-2026-109619: Laserfiche products do not use PHP.
- Laserfiche Mobile Server inadvertently installs .php files. They are test files that were included with a 3rd party library. They are not used in running the Laserfiche Mobile Server and can be deleted. The files are in "dijit" and "dojox" subfolders of <Install path>\Web Files\js-src.
- Compromised keys for eMudhra intermediate certificate authority: Laserfiche services do not utilize certificates signed by eMudhra, also known as emSign. Laserfiche will be updating all internal services to remove emSign certificates from trust stores, where they are present, out of an abundance of caution.
3
0