v0.31.9.0 Security Patch: Critical Stored XSS, FileEditor Defects, and Hardening

Vulnerability Overview v0.31.9.0 — Security Hardening & Patch Release - Release Date: 2026-05-08 - Type: Security Patch - Severity: Critical - High Impact Scope This release closes ten security vulnerabilities involving the authentication layer, file editor, content management module, and backup subsystem. Three vulnerabilities were responsibly disclosed by security researcher @offset. Remediation Security Fixes 1. [CRITICAL] Stored XSS — Blog Content (html_purity bypass) - Issue: The custom validation rule applied to the blog content field, but the output cleaned by was not persisted during update operations. - Fix: Enforce persistence of the output in both create and update operations. 2. [CRITICAL] Stored XSS — Pages Content (html_purity bypass) - Issue: In the Pages module, validation runs, but the raw, uncleaned value is written to the database upon update. - Fix: Enforce persistence of the output in create and edit endpoints. 3. [HIGH] FileEditor — Destructive Operations Extension Allowlist Missing - Issue: The dangerous extension blacklist is enforced on , , and (write paths), but not on or rename target validation. - Fix: Add explicit extension allowlist checks to all delete operations. Additional Hardening CSRF Architecture Overhaul - Centralized in to automatically inject CSRF tokens into all AJAX requests. - Elfinder routes are excluded via to prevent stable token 403 errors in multi-request sessions. HTMLPurifier Hardening - Removed URI scheme from (preventing XSS bypass). - Disabled ; enabled for automatic . - Blog and page controllers now always persist the output. IP Spoofing Fix - Removed direct reading of / from ; replaced with CI4's , respecting . Raw $SERVER Elimination - All reads of , , and are replaced with CI4 , , and helpers across , , , and . FileEditor RCE Prevention - Added blacklist to / / . - Added override protection to ; added boundary validation to . SQL Restore Hardening - Implemented SQL statement whitelist ( , , ...) and dangerous command blacklist ( , , , ...) in . - Added path traversal protection; backup files must reside within . Hardcoded Credentials Removed - Removed plaintext passwords from configuration. - Implemented hashed passwords; is enabled by default. Other Changes DevGate CLI Sync - now automatically updates admin credentials in during installation. Proxy Configuration - Added example configurations for Cloudflare and Nginx reverse proxies as comments in . URI Schemes - Removed unused and new URI schemes from configuration. Upgrade Instructions No database migrations required. Pull or download new files. Clear application cache: . If has been customized, review the updated and methods to ensure compatibility with the new extension allowlist. If using a reverse proxy (Cloudflare, Nginx), configure to enable IP detection. Acknowledgements Special thanks to @offset for responsibly disclosing three vulnerabilities (2× Stored XSS, FileEditor destructive operations bypass) that have been patched in this release. Full Changelog 0.31.8.9 — 0.31.9.0 Assets No specific asset information.

Goal Reached Thanks to every supporter — we hit 100%!

v0.31.9.0 Security Patch: Critical Stored XSS, FileEditor Defects, and Hardening

More from this source