fix: disable session.upload_progress (CERT-EU 2026-018 / CVE-2026-109619)

PHP 8.3.35 in wordpress:7.1.3 is vulnerable to CVE-2026-109618 and
CVE-2026-109619. The real fix is the rebuilt official image on PHP
8.3.36; this disables the confirmed session upload-progress exploit
path as defence in depth and bumps the version so operators redeploy
and re-pull the image.

abra.sh

@@ -1,4 +1,4 @@
-export PHP_UPLOADS_CONF_VERSION=v4
+export PHP_UPLOADS_CONF_VERSION=v5
 export ENTRYPOINT_CONF_VERSION=v10
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:7.1.4"
+    image: "wordpress:7.1.3"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
@@ -63,7 +63,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=4.1.1+7.1.3"
+        - "coop-cloud.${STACK_NAME}.version=4.1.2+7.1.3"
 
   db:
     image: "mariadb:13.0"

tests/test_templates.sh

@@ -216,6 +216,10 @@ test_uploads_default() {
         echo "  FAIL  uploads default: expected 30 max_execution_time"
         return 1
     fi
+    if ! echo "$output" | grep -q "session.upload_progress.enabled = Off"; then
+        echo "  FAIL  uploads default: expected session.upload_progress disabled"
+        return 1
+    fi
     echo "  PASS  uploads default"
 }
 

uploads.ini.tmpl

@@ -8,4 +8,6 @@ upload_max_filesize =  {{ $upload_max_size }}
 post_max_size = {{ $upload_max_size }}
 memory_limit = {{ $upload_max_size }}
 max_execution_time = {{ $upload_max_time }}
-max_input_time = {{ $upload_max_time }}
+max_input_time = {{ $upload_max_time }}
+
+session.upload_progress.enabled = Off