recipe-maintainers/wordpress
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix: disable session.upload_progress (CERT-EU 2026-018 / CVE-2026-109619)
cc-ci/testme cc-ci: success
Details

Browse Source 
PHP 8.3.35 in wordpress:7.1.3 is vulnerable to CVE-2026-109618 and
CVE-2026-109619. The real fix is the rebuilt official image on PHP
8.3.36; this disables the confirmed session upload-progress exploit
path as defence in depth and bumps the version so operators redeploy
and re-pull the image.
This commit is contained in:
trav
2026-10-21 09:35:10 -07:00
parent 49c4b520d9
commit 7fc19b6264
4 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
uploads.ini.tmpl
+3 -1
View File
@@ -8,4 +8,6 @@ upload_max_filesize = {{ $upload_max_size }}
post_max_size = {{ $upload_max_size }}
memory_limit = {{ $upload_max_size }}
max_execution_time = {{ $upload_max_time }}
max_input_time = {{ $upload_max_time }}
max_input_time = {{ $upload_max_time }}
session.upload_progress.enabled = Off