We have tagged security updates for Flow and recommend that you update your Neos and Flow instances to these versions immediately.
For more information see: Unauthenticated arbitrary file upload / potential RCE · Advisory · neos/flow-development-collection · GitHub
Thanks to all the contributors who helped with this release <3
- @dlubitz
- @nezaniel
- @skurfuerst
- @kdambekalns
- @mhsdesign
- @kitsunet
- @bwaidelich
- @ahaeslich
- @robertlemke
- @smeyer-p2er
The following fixes are included in the new versions 8.3.22, 8.4.7, 9.0.10, 9.1.5 and 9.2.3:
- BUGFIX: RedisBackend::flushByTags() returns the total over all batches #3633
- BUGFIX: Check file extensions in all cases of file uploads
- BUGFIX: Discard new resources if request fails
- BUGFIX: Enforce the action policy before calling the error action
- TASK: Add upload restriction tests
See also: