Skip to content

eXtplorer 3.1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 08:06
v3.1.2
b8ded93

[3.1.2] - 2026-10-20

Security

  • Fix the application-controlled Sendmail executable reported by dutchypoo in GHSA-x294-8g9c-m6fc. Sendmail now uses only an operator-configured executable outside application-managed storage, with trusted filesystem ownership and permissions and shell-safe quoting.
  • Require explicit settings permission and recent reauthentication for mail probes. Probes use saved settings only, reject overrides, share an account rate limit and return safe error codes without SMTP diagnostics.
  • Limit delegated user, role and group administration to the administrator's current permissions, home scope and extension restrictions, including indirect changes and stronger accounts.
  • Refuse legacy FTPS in strict mode because PHP's FTP extension cannot authenticate the actual connection. Confine FTP passive data connections to the authorized control peer.
  • Add security regression tests, isolated transport fixtures and pinned source scanning.

Upgrade requirements

  • Back up configuration, writable data and the encryption key before upgrading. For a custom Sendmail binary, set EXTPLORER_SENDMAIL_PATH in the server environment; the old web setting is never executed. The executable and every path component must be protected from modification by the PHP worker. Otherwise select SMTP or PHP mail.
  • Save and retest mail settings after upgrading; old delivery confirmations are invalidated. Mail validation and test delivery require recent reauthentication and saved settings.
  • Delegated administrators need admin_settings to access settings. admin_users alone no longer grants it; account, role and group changes cannot exceed delegated authority.
  • Use SFTP instead of strict-mode legacy FTPS. Only an operator's explicit compatibility policy enables the legacy FTPS transport, with its documented certificate-verification limitation.

Installation and upgrade

Use eXtplorer-3.1.2-release.zip and verify its accompanying SHA-256 file. GitHub's automatically generated source archives are not installation packages.

Back up the writable tree, configuration, encryption key and any external storage/database before upgrading. Keep the same writable state, configuration and encryption key. Native installations support PHP 8.2–8.5; replace application files without overwriting writable data and run php spark security:migrate. Container users can pin ghcr.io/soerennb/extplorer3:3.1.2 or its immutable digest and run the documented Compose update procedure. The init container activates the new code release automatically. SFTP is bundled and no longer needs the optional SSH2 extension.

For rollback, stop writes, restore the previous image/application and matching data/configuration backup. See installation and Docker update/rollback instructions.

Validation

Assets 4
Loading