Loophole-LLC/Bastillion v6.0.4

6.0.4

on GitHub

Security

• Moderate: one user could push, overwrite or delete another user's upload. Upload & Push staged every file in one directory shared by all users, under the uploaded file's own name, and pushed whichever file the request named. A signed-in administrator who knew or guessed the name of a file another user had uploaded but not yet finished pushing could push it to a system of their own and read it, upload a file of the same name so the other user pushed their content instead (to systems outside their own profiles), or delete it. Each upload is now staged under a random name, kept in the uploader's session, and only that session can push or delete it. Found by Liam Giannini (@Liam-G).
• Thymeleaf 3.1.6 brings OGNL 3.4.17, which fixes CVE-2026-113730 (GHSA-crwc-vw2r-qr6m), a bypass of OGNL's stricter-invocation block list. Bastillion does not evaluate expressions from users, so it was not exploitable here; the update clears the alert.

Fixed

• Building from source works again. 6.0.3 depended on a commons-fileupload2 snapshot that Apache has since removed from its repository, so a clean checkout of 6.0.3 no longer builds. It now uses the released commons-fileupload2-jakarta-servlet6 2.0.0-M5.

Dependencies

• org.thymeleaf:thymeleaf 3.1.5 → 3.1.6 (ognl:ognl 3.3.4 → 3.4.17)
• org.apache.commons:commons-fileupload2-jakarta 2.0.0-SNAPSHOT → commons-fileupload2-jakarta-servlet6 2.0.0-M5
• com.google.code.gson:gson 2.14.0 → 2.15.0
• Test and build only: org.apache.sshd:sshd-core/sshd-sftp 2.20.0 → 2.20.1, com.unboundid:unboundid-ldapsdk 7.0.5 → 7.0.6, maven-surefire-plugin 3.6.0 → 3.6.1, maven-enforcer-plugin 3.6.3 → 3.7.0

Upgrade notes:

Upgrading from v4? v4 kept its H2 database inside the Jetty webapp, encrypted with that install's keystore, so 6.x cannot read it in place. Use the migration tool — you do not need to install 5.x first, you can import straight into 6.0.4:

# 1. export from the old v4 install (its WEB-INF/classes is the config dir)
./migrate.sh export /opt/Bastillion-jetty/jetty/bastillion/WEB-INF/classes/ ~/export.json

# 2. start 6.0.4 once against the new config dir, then stop it - creates schema + keystore
java -DCONFIG_DIR=/data/bastillion/ -jar bastillion-6.0.4.jar

# 3. import
./migrate.sh import /data/bastillion/ ~/export.json --yes-replace-all-data

# 4. the export holds plaintext secrets - delete it
rm ~/export.json

Users keep their existing passwords. Every column a v4 export carries still exists in the 6.0.0 schema, and the two columns 6.0.0 adds to those tables take their default or null. Full details in tools/migrate/README.md. bastillion-migrate-1.0.0.jar is attached to this release, and migrate.sh fetches it automatically, verifying its checksum.