VortexPanel v3.4.14 – v3.4.16 — Combined Release Summary

VortexPanel v3.4.14 – v3.4.16 — Combined Release Summary

Security
OS command injection fixed across file management (v3.4.14) — search, scan, compress, extract, and lint in the file manager were vulnerable to shell command injection via unsanitized input passed to shell=True subprocess calls. Confirmed exploitable with a real proof-of-concept before fixing; every affected call converted to safe argument-list form.

The real root cause behind repeated install failures (v3.4.14)

Discovered that panel/routes/os_utils.py silently overrides the main App Store install logic for eight core apps — nginx, MariaDB, PostgreSQL, Redis, MongoDB, Docker, Node.js, and PHP — on the actual "Install" button. Earlier fixes made directly to the visible install scripts for these apps had no effect, because this hidden layer ran instead. Once found, the real Debian/Ubuntu path bugs for nginx, MariaDB, MongoDB, PHP, and Node.js were fixed in the code that actually executes.

CloudLinux and general RHEL-derivative detection (v3.4.15)

CloudLinux was completely unrecognized by OS detection — since it wasn't in any matched list, it silently fell through to the code's own default value of "Debian," meaning every affected app would have tried apt-get commands on a dnf/yum system. Fixed with explicit CloudLinux recognition, plus a general fallback so any future or currently-unlisted RHEL/Fedora derivative is caught the same way.

Full CentOS Stream 9 / RHEL-family audit — all 26 App Store modules (v3.4.16)

The most significant fix: nginx and MongoDB's RHEL repo files were built via an unquoted bash heredoc, causing 𝑟 𝑒 𝑙 𝑒 𝑎 𝑠 𝑒 𝑣 𝑒 𝑟 ‘ / ‘ releasever‘/‘basearch — variables meant for DNF to resolve — to be silently expanded to empty strings by bash before DNF ever saw the file. This produced a permanently broken URL (.../rhel///) on every single RHEL-family install. Reproduced this directly before fixing.

Also fixed, individually verified per app:

Apache2 — install-check never recognized httpd (the actual RHEL binary name), so a successful install still reported as failed
OpenLiteSpeed — had no RHEL-specific install path at all, and hit a real, independently-confirmed upstream OpenLiteSpeed packaging bug on EL9; added the community-confirmed Remi repository workaround
Pure-FTPD — tried installing a package (pure-ftpd-common) that doesn't exist on RHEL, failing the entire install
ClamAV — used entirely wrong RHEL package and service names
Roundcube — wrong PHP package name, plus a hardcoded system user that doesn't exist on RHEL
ModSecurity — RHEL's nginx connector now compiles from source against the actually-installed nginx version, avoiding a likely binary-compatibility mismatch from a prebuilt package

Individually verified as already safe: MySQL, MariaDB, PostgreSQL, Redis, Docker, Bind9, Memcached, Composer, Supervisor, ffmpeg, DDNS Manager, CDN Manager, Caddy, Nginx Load Balancer. Node.js's RHEL install path confirmed still current against NodeSource's own official documentation.

Also in this range
Fixed the Quick Install command in the README using wget, which isn't present on minimal installs like CentOS Stream 9 — switched to curl, which is far more universally available.