c4dt/nextcloud
0
0
Fork 0
forked from coop-cloud/nextcloud
Code Pull Requests Activity

chore: publish 16.2.1+35.0.2-fpm release

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Linus Gasser
2026-10-21 16:11:53 +02:00
co-authored by Claude Opus 5.5
parent f0d108d90b
commit bef5ddce09
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
release/16.2.1+35.0.2-fpm
+12
View File
@@ -0,0 +1,12 @@
Interim mitigations for the critical PHP RCE vulnerabilities CVE-2026-109618
and CVE-2026-109619 (https://www.php.net/archive/2026.php#2026-10-21-5).
The nextcloud:35.0.2-fpm image still ships PHP 8.5.11; a patched image is not
yet available. Upgrade as soon as one with PHP >= 8.5.12 is released.
Added to the PHP-FPM pool (fpm-tune.ini, FPM_TUNE_VERSION v6):
- memory_limit = -1 (PHP_MEMORY_LIMIT is ignored for web requests)
- post_max_size = 32M, upload_max_filesize = 30M (PHP_UPLOAD_LIMIT is ignored
for web requests). WebDAV/chunked uploads use PUT and are not affected.
- session.upload_progress.enabled = off
- fatal_error_backtraces = off