We are very pleased to announce the availability of Foswiki 2.1.8. This release contains 61 fixes relative to 2.1.7, including 9 critical security related fixes.

Most notable are:

• CVE-2023-33756: SpreadSheetPlugin's EVAL feature exposes information about paths and files on the server
• CVE-2023-24698: Local file inclusion vulnerability in viewfile

But also:

• directories in working directory are created as world writable 777 permissions
• possible XSS attack in attachment comments
• restricted allowed protocols to http and https, i.e. forbid file protocol for local file inclusion
• prevent symlink attacks by defaulting to a secure location for temporary files
• update to jquery-ui 1.13.2
• backport patch to earlier jQuery versons to fix a potential XSS vulnerability
• possible XSS vulnerability in topic title field

For more details read the release notes

You can download it from different locations immediately, see our download page for details. Please use our task tracker to report any issues. Or contact us on online via IRC or Slack.

For installation information, see the System Requirements and the Installation Guide.

timlegge/docker-foswiki has been updated to Foswiki 2.1.7. What you need to know to upgrade your instance.

We are very pleased to announce the availability of Foswiki 2.1.7.

This release addresses significant security issues we discovered in all previous Foswiki releases.

Upgrade to Foswiki 2.1.7 is highly recommended.

This release comes with a total of 110 fixes and enhancements as well as 7 security fixes.

For more details read the release notes

You can download it from different locations immediately, see our download page for details. Please use our task tracker to report any issues. Or contact us on online via IRC or Slack.

For installation information, see the System Requirements and the Installation Guide.

We are very pleased to announce the availability of Foswiki 2.1.6.

This release addresses a significant security issue we discovered in Foswiki 1.1.0 - 2.1.5, where under some conditions the User Registration topic can be compromised. During review we tightened up a couple of additional security concerns.

Upgrade to Foswiki 2.1.6 is highly recommended.

Welcome everybody to 2018! We start the year with another patch level release of the 2.1 series: 2.1.5 comes with 48 fixes and enhancements, 19 extensions have been updated. Most importantly, we fixed installing Foswiki on a Windows server.

Thank you to the community that has been working hard on this project.