Skip to content

IceHrm v36.0.2

Latest
Latest

Choose a tag to compare

View all tags
@ddave001 ddave001 released this 05 Nov 19:23
· 2 commits to master since this release
v36.0.2
734a6a8

⚠️ IceHrm updates itself. When a newer release is published, administrators see a banner on the dashboard — click Update and the updater downloads it, backs up your current version, and replaces the program files. No terminal, and one-click rollback if anything goes wrong.

More information about the upgrade process can be found here.

This is a security and bug-fix release for v36.0.1. Upgrading is recommended for all installations.

🔐 Security Fixes

  • Hardened upload directory access on Docker/nginx installations. (#386)
  • Managers could upload or replace files for any employee. The upload permission check treated every Manager as globally privileged. Managers are now limited to themselves and the employees they manage, the same rule used everywhere else in IceHrm. This covers file, common and editor uploads. (#386)
  • Docker images updated to PHP 8.3.36. This fixes two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). The production, worker and development images now use Alpine 3.22. Docker users: recreate your containers from the new images for the fix to take effect.

🐞 Bug Fixes

  • "Failed to load the app shell: bootstrap failed: 403" after login on Apache + PHP-FPM (e.g. AlmaLinux / RHEL 9). Apache was not passing the Authorization header to PHP. It is now forwarded by app/api/.htaccess and read correctly by the REST layer. (#379, #399)
  • The updater could not install v36.0.1. v36.0.1 shipped with an outdated internal version number, so 36.0.0 installations were told they were "Already up to date". The version number is corrected, and the release build now fails if it falls out of sync. (#386)

📄 License

  • IceHrm is licensed under the GNU General Public License v3 again, replacing the Elastic License 2.0 used in v36.0.1. (#400)
  • Removed the old commercial license files left in the audit, employees, salary, training and leave modules, so GPLv3 applies to the whole application. Third-party library licenses are unchanged. (#401)
Assets 3
Loading