CPalius CMF 2.2.10
Released: 2026-09-24 · Channel: stable · Critical: yes
A full white-hat security audit of the codebase found six real issues in the core and shipped modules. None were found exploited in the wild; all are fixed in this release.
What's fixed
A Redis connection password could be stored in plain text. performance.redis.password was declared as a plain text setting instead of password, so SystemSettingsService never encrypted it and the AACP performance settings page echoed it back unmasked. The definition is now password, and an update hook seals any existing plaintext value on first run — no manual step needed.
Sessions on a shared Redis server could collide between two CPalius installs. RedisSessionHandler used its hardcoded default key prefix (sf_s), identical on every install. Two sites sharing one Redis server therefore wrote into the same session-key namespace: an admin of one site could enumerate, read or wipe another site's live sessions with redis-cli. The prefix is now derived from each install's own APP_SECRET, the same fix already applied to the cache layer in 2.2.8.
Logging in leaked whether an account was banned, pending approval, or unverified — before the password was checked. Symfony runs UserCheckerListener ahead of credential verification, so a status-specific error message shown at that stage let anyone learn an account's moderation state by submitting its email with any password, with no valid credential required. The check now runs after the password is verified.
AI-translated content skipped the sanitizer every human-authored post and page already goes through. Blog and Page auto-translation wrote the AI provider's HTML straight to the database and rendered it unescaped on the public site, unlike the editorial path (Manifesto Law 5.3), which always sanitizes first. A manipulated or compromised translation provider response could have injected a stored XSS payload into a published page. Both publishers now sanitize before saving, matching the human path.
A forum moderator could plant a stored XSS payload in a member's bio. Bio edits made through the forum member-management screen were saved unsanitized and rendered raw on the public forum profile and blog author cards; the equivalent full-admin screen already sanitized correctly. Both paths now match.
The DnsTools SSRF guard could be bypassed with a DNS-rebinding attack. Probes validated a target hostname, then reconnected using the hostname a second time — letting a low-TTL DNS record switch from a public IP (at validation) to an internal one (at connect) and reach internal hosts through the port/HTTP/TLS/WHOIS/SMTP probe tools. Probes now connect directly to the address that was validated instead of resolving the hostname again.
Upgrade notes
No schema changes. Everyone logged in when this update runs will be signed out once, because the Redis session key prefix changes — this is expected, not a bug. If performance.redis.password was previously configured, it is re-encrypted automatically the first time this update runs; no action needed.
Known limitations
This release covers the CPalius CMF product only. If you run other, unrelated code on the same host, it is outside this project's scope and was not part of this audit.