Zikula Core 1.3.8 is released as of 01 August 2014. This is a security release for the Core 1.3.x series. All users of Core 1.3.0 - 1.3.7 are recommended to update as soon as possible.
In addition to addressing the security issue, Smarty is updated to version 2.6.28 in this release. The blocks module receives an update to let the html block work together with Scribite 5.0 using hooks. Also several minor bugs have been fixed.
Installation/Upgrade: (from Core 1.3.6 and 1.3.7) Be sure to backup files and database before any upgrade is attempted. Simply overwrite the files in your current installation with the new files , add your DB credentials to the config.php file and run the upgrade.php routine.
A full Changelog is available.