If you are running XenForo 2.3.13, these additional patches do not apply to you.
Today we are releasing a further round of patches for all releases from XenForo 2.2.0 - 2.3.12, alongside applicable XenForo Media Gallery updates. This contains the same fixes as the recent patch release (thanks again to Marco Paciaroni (BomboBombone) for the work there).
The reason for this second round of patches is to focus on the "cumulative" part and close a gap highlighted by the new patch process we introduced for the previous release and ensure that gap is closed for good for all future releases. Specifically, some of the versions released prior may have omitted security updates from previous patch releases, where those patches were applied manually.
To provide a concrete example of this, if you were previously running XenForo 2.3.6 you should have previously applied security fixes from 2.3.7, 2.3.9 and 2.3.10 manually. XenForo 2.3.6 Patch 1 did not include these additional fixes. It only included the new security fixes from 2.3.13. While it is theoretically possible you could have re-applied those patches manually, re-applying multiple patches by hand can be tricky and prone to errors.
As a result of this oversight, and to make future security patches clearer and easier, we have decided to re-release all affected patches which now include the cumulative security fixes that you may have otherwise been missing. To go back to the previous example, this means that the newly released XenForo 2.3.6 Patch 2 now includes all security fixes from XenForo 2.3.7, 2.3.9, 2.3.10 and 2.3.13.
Future security releases will now automatically be based on the now cumulative version of each release.
We strongly recommend that all customers running XenForo 2.2.x or 2.3.x upgrade to the patch release corresponding to their currently installed version as soon as possible. Where available, we recommend using one-click upgrades to apply the upgrade for you.
As a reminder, XenForo Cloud customers have already received the relevant patches as part of a modified XenForo 2.3.11 release. XenForo 2.3.13 will be scheduled for XenForo Cloud customers later today.
If you are able to, we strongly recommend upgrading to XenForo 2.3.13 which, as well as the security issues here, also adds the usual swathe of fixes and improvements. See the separate 2.3.13 release announcement for details of those changes.
If you are a XenForo Cloud customer, your installations have already been patched and no further action is required. You will remain on version 2.3.11. 2.3.13 is also being released with other bug fixes and improvements.
As always, new releases of XenForo are free to download for all customers with active licenses. You may now upgrade from your admin control panel or grab the new version from the customer area.
Full details of how to install and upgrade XenForo can be found in the XenForo manual. We strongly recommend upgrading directly from within your control panel.
Today we are releasing a further round of patches for all releases from XenForo 2.2.0 - 2.3.12, alongside applicable XenForo Media Gallery updates. This contains the same fixes as the recent patch release (thanks again to Marco Paciaroni (BomboBombone) for the work there).
The reason for this second round of patches is to focus on the "cumulative" part and close a gap highlighted by the new patch process we introduced for the previous release and ensure that gap is closed for good for all future releases. Specifically, some of the versions released prior may have omitted security updates from previous patch releases, where those patches were applied manually.
To provide a concrete example of this, if you were previously running XenForo 2.3.6 you should have previously applied security fixes from 2.3.7, 2.3.9 and 2.3.10 manually. XenForo 2.3.6 Patch 1 did not include these additional fixes. It only included the new security fixes from 2.3.13. While it is theoretically possible you could have re-applied those patches manually, re-applying multiple patches by hand can be tricky and prone to errors.
As a result of this oversight, and to make future security patches clearer and easier, we have decided to re-release all affected patches which now include the cumulative security fixes that you may have otherwise been missing. To go back to the previous example, this means that the newly released XenForo 2.3.6 Patch 2 now includes all security fixes from XenForo 2.3.7, 2.3.9, 2.3.10 and 2.3.13.
Future security releases will now automatically be based on the now cumulative version of each release.
We strongly recommend that all customers running XenForo 2.2.x or 2.3.x upgrade to the patch release corresponding to their currently installed version as soon as possible. Where available, we recommend using one-click upgrades to apply the upgrade for you.
As a reminder, XenForo Cloud customers have already received the relevant patches as part of a modified XenForo 2.3.11 release. XenForo 2.3.13 will be scheduled for XenForo Cloud customers later today.
If you are able to, we strongly recommend upgrading to XenForo 2.3.13 which, as well as the security issues here, also adds the usual swathe of fixes and improvements. See the separate 2.3.13 release announcement for details of those changes.
One-click upgrade
Directly from your admin control panelIf you are a XenForo Cloud customer, your installations have already been patched and no further action is required. You will remain on version 2.3.11. 2.3.13 is also being released with other bug fixes and improvements.
As always, new releases of XenForo are free to download for all customers with active licenses. You may now upgrade from your admin control panel or grab the new version from the customer area.
Full details of how to install and upgrade XenForo can be found in the XenForo manual. We strongly recommend upgrading directly from within your control panel.
Last edited by a moderator: