Release v1.7.9 - Fix arbitrary PHP file inclusion, HTML injection/XSS vulnerability in filenames of attached files & self-XSS vulnerabilities #1714
elrido
announced in
Announcements
Replies: 1 comment 2 replies
-
|
If anyone uses the 1.7 container images, which all should already be using PHP 8.x and has some other reason not to upgrade to 2.x, please speak up here. If you provide me a sensible reason, I'll see about creating backport container images as well, though that will be a bit messier, as the |
Beta Was this translation helpful? Give feedback.
2 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
This release addresses issues with arbitrary PHP file inclusion when enabling template switching and lacking sanitation of file names when drag-&-dropping files into PrivateBin with malicious filenames. More details on this issue can be found in the security advisories:
Note that as per our security policy, we only consider the latest release to be supported, so do consider upgrading your 1.7 install to 2.x as soon as possible. This backport was provided due to the major changes that come with the 2.x release and for use in installations that don't yet have PHP 7.4 or later support available.
This discussion was created from the release Release v1.7.9 - Fix arbitrary PHP file inclusion, HTML injection/XSS vulnerability in filenames of attached files & self-XSS vulnerabilities.
Beta Was this translation helpful? Give feedback.
All reactions