Kaleta 3.6.1 (security)

Kaleta 3.6.1 is a security release. Sites with automatic security updates (the default) install it by themselves.

Fix

• SVG uploads (stored XSS). The cleaner that removes scripts from uploaded SVG images could miss an attribute when two attributes on one element shared a local name – for example onload next to x:onload, or href next to xlink:href. An uploaded SVG could then keep a live onload handler or a data: link. Every attribute is now checked. This affected every PHP version and every earlier release with SVG uploads.

The issue was found by the security review of the upcoming 3.7, in a large automated comparison of how Kaleta's sanitizers handle unusual markup.

Updating

Sites with automatic security updates install it by themselves. You can also update from Settings → Backups and updates. No database changes.