Skip to content

v0.3.8

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 18:24
· 3 commits to main since this release
v0.3.8
41248d0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Image: ghcr.io/karatektus/pl_mail:0.3.8

The image runs PHP 8.4.27, which fixes CVE-2026-109618 and CVE-2026-109619. Every earlier image, v0.3.7 included, ran PHP 8.4.26, which is open to both. One of them can be reached by any multipart request, with no sign-in and no upload form needed, and the advisory considers FrankenPHP susceptible. Exploit code is public, so update. plMail itself is unchanged: the FrankenPHP base image the build starts from now carries the fixed PHP, and this release is that rebuild. No schema change. #280.

Assets 2
Loading