XNAT 1.10.2.1 Release Notes

XNAT 1.10.2.1 is a security hotfix release, based on XNAT 1.10.2.

A security vulnerability in XNAT allows an unauthenticated attacker to obtain an account with privileges up to and including site administrator. Site administrator privileges give the attacker full control of the XNAT site and all its data.

To exploit the vulnerability, the attacker must be able to reach the site's web interface. If access is restricted by a firewall or VPN, the attacker must first have access to the restricted network.

All sites should update immediately. Sites that cannot update immediately should contact security@xnat.org for temporary mitigation steps.

This release does not introduce plugin compatibility changes.

To upgrade, see How To Upgrade XNAT. Download at www.xnat.org/download.