# CPalius CMF 2.2.10

**Released:** 2026-09-24 · **Channel:** stable · **Critical:** yes

Turkish: [2.2.10-tr.md](2.2.10-tr.md)

A full white-hat security audit of the codebase found six real issues in the core and shipped modules. None were found exploited in the wild; all are fixed in this release.

## What's fixed

**A Redis connection password could be stored in plain text.** `performance.redis.password` was declared as a plain `text` setting instead of `password`, so `SystemSettingsService` never encrypted it and the AACP performance settings page echoed it back unmasked. The definition is now `password`, and an update hook seals any existing plaintext value on first run — no manual step needed.

**Sessions on a shared Redis server could collide between two CPalius installs.** `RedisSessionHandler` used its hardcoded default key prefix (`sf_s`), identical on every install. Two sites sharing one Redis server therefore wrote into the same session-key namespace: an admin of one site could enumerate, read or wipe another site's live sessions with `redis-cli`. The prefix is now derived from each install's own `APP_SECRET`, the same fix already applied to the cache layer in 2.2.8.

**Logging in leaked whether an account was banned, pending approval, or unverified — before the password was checked.** Symfony runs `UserCheckerListener` ahead of credential verification, so a status-specific error message shown at that stage let anyone learn an account's moderation state by submitting its email with any password, with no valid credential required. The check now runs after the password is verified.

**AI-translated content skipped the sanitizer every human-authored post and page already goes through.** Blog and Page auto-translation wrote the AI provider's HTML straight to the database and rendered it unescaped on the public site, unlike the editorial path (Manifesto Law 5.3), which always sanitizes first. A manipulated or compromised translation provider response could have injected a stored XSS payload into a published page. Both publishers now sanitize before saving, matching the human path.

**A forum moderator could plant a stored XSS payload in a member's bio.** Bio edits made through the forum member-management screen were saved unsanitized and rendered raw on the public forum profile and blog author cards; the equivalent full-admin screen already sanitized correctly. Both paths now match.

**The DnsTools SSRF guard could be bypassed with a DNS-rebinding attack.** Probes validated a target hostname, then reconnected using the hostname a second time — letting a low-TTL DNS record switch from a public IP (at validation) to an internal one (at connect) and reach internal hosts through the port/HTTP/TLS/WHOIS/SMTP probe tools. Probes now connect directly to the address that was validated instead of resolving the hostname again.

## Upgrade notes

No schema changes. Everyone logged in when this update runs will be signed out once, because the Redis session key prefix changes — this is expected, not a bug. If `performance.redis.password` was previously configured, it is re-encrypted automatically the first time this update runs; no action needed.

## Known limitations

This release covers the CPalius CMF product only. If you run other, unrelated code on the same host, it is outside this project's scope and was not part of this audit.