CSF 2.3.2 - Core Shield Firewall (security update)

CSF 2.3.2 - Core Shield Firewall (stable)

Release date: 2026-11-06
Headline: Security update - please update

A security update from our own audit of 2.3. Update every server running CSF 2.3.x.

• Critical: the firewall interface could run a script from an uploaded file name. The
  comment the malware scanner writes for a blocked uploader includes the file name, and the
  allow, deny and temporary lists showed comments without escaping them. A crafted file name
  could run a script in the administrator's interface (inside WHM on cPanel). Comments are now
  escaped, and the scanner removes markup from file names before storing them.
• High: quarantine restore no longer writes as root. A restore could follow a folder that
  the site owner had replaced with a symbolic link and write the file outside the website. A
  restore now refuses any path through a symbolic link and writes the file as its original
  owner.
• Quarantine never follows a symbolic link swapped in after the scan, and only removes the
  file it actually scanned.
• The web interface trusts a proxy's visitor address only with a secret key. Other
  processes on the server could send a fake address to slip past the sign-in lockout or get
  another address blocked. The installer creates /etc/csf/ui.proxykey and adds it to the
  nginx sites that proxy to the interface. Sign-in is also paused for everyone after 50 failed
  attempts in 15 minutes.
• File names with line breaks are no longer scanned (they are reported as suspicious), and
  scanner results are only accepted for files that were actually scanned.
• The version now comes from a single VERSION file.

Upgrade from the interface (Update tab) or with csf --self-update. Configuration and lists are
kept. Behind your own reverse proxy (not nginx), add the header
X-CSF-Proxy-Key: <contents of /etc/csf/ui.proxykey> so the interface sees visitor addresses.

CSF 2.3.1 - Core Shield Firewall

CSF 2.3.1 - Core Shield Firewall (stable)

Release date: 2026-11-06
Headline: Never lock out the administrator

A safety update for 2.3.0: CSF never locks out its own administrator.

• The installer allows your SSH address. Like legacy ConfigServer CSF, the IP of the
  SSH session running install.sh is added to the allow list (comment "Administrator
  (SSH session used to install CSF)"), also when the installer runs under sudo.
  Updates run from cron or the web interface have no SSH session and skip this step.
• The malware scanner never blocks a trusted uploader. An uploader on the allow list,
  in csf.ignore, or an administrator who signed in to the CSF web interface is never
  blocked; the file is still quarantined. On servers without a control panel the web
  interface shares the web server log with the websites, so an administrator signing in
  at the moment a malicious file was uploaded could be taken for its uploader and blocked.
• csf --scan-setup runs the first scan right away (files changed in the last hour)
  instead of waiting for the 5-minute schedule, so csf --selftest is green straight away.

Upgrade from the interface (Update tab) or with csf --self-update. Configuration and
lists are kept. Everything in 2.3.0 is included - see the changelog.