recipe-maintainers/wordpress
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: disable session.upload_progress (CERT-EU 2026-018 / CVE-2026-109619) #2

Open
autonomic-bot wants to merge 1 commits from pr-20261021-190326 into main
pull from: pr-20261021-190326
merge into: :main
Conversation 2 Commits 1 Files Changed 4
+9 -3
autonomic-bot commented 2026-10-21 19:03:31 +00:00
Owner
Copy Link
Copy Source

Security fix for CERT-EU 2026-018: PHP CVE-2026-109618 / CVE-2026-109619, unauthenticated RCE, PHP < 8.3.36. The recipe uses mod_php, which the advisory rates highest risk.

Image: wordpress:7.1.3 was rebuilt upstream on PHP 8.3.36 (new digest sha256:30c76f0a…). The tag is unchanged, so this bumps the recipe to 4.1.2+7.1.3 so that deploying it pulls the patched image.

Mitigation: session.upload_progress.enabled = Off in uploads.ini.tmpl (PHP_UPLOADS_CONF_VERSION v4 → v5). This blocks the confirmed CVE-2026-109619 session path as defence in depth. WordPress doesn't use this feature.

Tested on cc-test

  • Upgrade 4.1.1 → 4.1.2: config v4 → v5, upload progress on → off, healthy
  • Fresh install + core_install: PHP 8.3.36 (apache2handler), admin login, media upload through async-upload.php
  • Backup → undeploy + delete volumes → redeploy → restore with hooks: marker post and uploaded file both came back

Operators: after deploying, check the PHP version with abra app run <domain> app -- php -v (should print 8.3.36).

cc @trav @notplants

Security fix for [CERT-EU 2026-018](https://cert.europa.eu/publications/security-advisories/2026-018/): PHP CVE-2026-109618 / CVE-2026-109619, unauthenticated RCE, PHP < 8.3.36. The recipe uses `mod_php`, which the advisory rates highest risk. **Image:** `wordpress:7.1.3` was rebuilt upstream on PHP 8.3.36 (new digest `sha256:30c76f0a…`). The tag is unchanged, so this bumps the recipe to `4.1.2+7.1.3` so that deploying it pulls the patched image. **Mitigation:** `session.upload_progress.enabled = Off` in `uploads.ini.tmpl` (`PHP_UPLOADS_CONF_VERSION` v4 → v5). This blocks the confirmed CVE-2026-109619 session path as defence in depth. WordPress doesn't use this feature. **Tested on cc-test** - Upgrade 4.1.1 → 4.1.2: config v4 → v5, upload progress on → off, healthy - Fresh install + `core_install`: PHP 8.3.36 (`apache2handler`), admin login, media upload through `async-upload.php` - Backup → undeploy + delete volumes → redeploy → restore with hooks: marker post and uploaded file both came back **Operators:** after deploying, check the PHP version with `abra app run <domain> app -- php -v` (should print 8.3.36). cc @trav @notplants
autonomic-bot added 1 commit 2026-10-21 19:03:31 +00:00
fix: disable session.upload_progress (CERT-EU 2026-018 / CVE-2026-109619)
cc-ci/testme cc-ci: success
Details
7fc19b6264 
PHP 8.3.35 in wordpress:7.1.3 is vulnerable to CVE-2026-109618 and
CVE-2026-109619. The real fix is the rebuilt official image on PHP
8.3.36; this disables the confirmed session upload-progress exploit
path as defence in depth and bumps the version so operators redeploy
and re-pull the image.
autonomic-bot requested review from trav 2026-10-21 19:03:31 +00:00
autonomic-bot requested review from notplants 2026-10-21 19:03:31 +00:00
autonomic-bot commented 2026-10-26 16:49:32 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-26 16:49:47 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — wordpress @ 7fc19b62 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `wordpress` @ `7fc19b62` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/85/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/85) [![level](https://ci.autonomic.zone/runs/85/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/85) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/85) · [dashboard](https://ci.autonomic.zone/)
All checks were successful
cc-ci/testme cc-ci: success
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin pr-20261021-190326:pr-20261021-190326
git checkout pr-20261021-190326
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (Aadil Ayub) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/wordpress#2