CSF 2.3.2 - Core Shield Firewall (security update)

CSF 2.3.2 - Core Shield Firewall (stable)

Release date: 2026-11-06
Headline: Security update - please update

A security update from our own audit of 2.3. Update every server running CSF 2.3.x.

• Critical: the firewall interface could run a script from an uploaded file name. The
  comment the malware scanner writes for a blocked uploader includes the file name, and the
  allow, deny and temporary lists showed comments without escaping them. A crafted file name
  could run a script in the administrator's interface (inside WHM on cPanel). Comments are now
  escaped, and the scanner removes markup from file names before storing them.
• High: quarantine restore no longer writes as root. A restore could follow a folder that
  the site owner had replaced with a symbolic link and write the file outside the website. A
  restore now refuses any path through a symbolic link and writes the file as its original
  owner.
• Quarantine never follows a symbolic link swapped in after the scan, and only removes the
  file it actually scanned.
• The web interface trusts a proxy's visitor address only with a secret key. Other
  processes on the server could send a fake address to slip past the sign-in lockout or get
  another address blocked. The installer creates /etc/csf/ui.proxykey and adds it to the
  nginx sites that proxy to the interface. Sign-in is also paused for everyone after 50 failed
  attempts in 15 minutes.
• File names with line breaks are no longer scanned (they are reported as suspicious), and
  scanner results are only accepted for files that were actually scanned.
• The version now comes from a single VERSION file.

Upgrade from the interface (Update tab) or with csf --self-update. Configuration and lists are
kept. Behind your own reverse proxy (not nginx), add the header
X-CSF-Proxy-Key: <contents of /etc/csf/ui.proxykey> so the interface sees visitor addresses.