THM-Health/PILOS v4.20.0

PILOS 4.20.0

on GitHub

This release of PILOS v4 addresses multiple security vulnerabilities discovered during in-depth security code reviews assisted by AI-powered tools, including CodeRabbit, Claude, and Grok.

The release fixes 9 vulnerabilities: 3 high-severity and 6 medium-severity.

We strongly recommend upgrading to this release as soon as possible.

The corresponding GitHub Security Advisories, including available workarounds, will be published shortly.

Please note: Workarounds are not available for all vulnerabilities. Upgrading to this release is therefore the recommended and most effective way to secure your installation.

Important notes for administrators

Please pay special attention to the following changes when upgrading:

• Custom Docker images: If you build your own PILOS Docker image, make sure to review and incorporate all code changes included in this release. In particular, pay attention to the changes in the nginx configuration. These changes are security-relevant and must not be omitted. Simply updating the application code without applying the corresponding configuration changes may leave your installation vulnerable.
• BigBlueButton callbacks: The meeting end callback URL signature has changed. Callbacks for meetings that are already running during the upgrade will fail. However, server-side polling will detect that the meeting has ended within one minute.
• Password reset links: All existing password reset links will be invalidated during the upgrade. Users who have requested a password reset before the upgrade will need to request a new link. If email delivery failed before the upgrade, queued email jobs containing invalid password reset links may still be pending and could be sent afterward. Administrators should check GHSA-74cm-rg6m-4g87 for instructions on how to clean up failed queued jobs.

To install this version, check our Getting Started Guide.

Changed

• Replaced the room file "view" button with a download button (#3588)
• Remove invalid characters from room file filenames on upload; existing files are rewritten using a DB migration (#3588)

Fixed

• Room authentication failing when the session is not yet persisted (#3603, #3604)
• Downloading room files with special or non-Latin characters (including quotes) in the filename (#3588)

Security

• Constrain Vue Router path parameters to valid identifier formats (GHSA-2rf6-6cmc-3767)
• Prevent spreadsheet formula injection in attendance exports (GHSA-rx2m-63p9-vh9f)
• Validate return URL of Shibboleth front-channel logout to prevent open redirects (GHSA-46f6-vjh7-jg8f)
• Store default presentation using content-based file extension instead of client Content-Type (GHSA-qr8q-4pjq-4r52)
• Configure nginx so only index.php is executed; other .php files under public/ return 404 (GHSA-qr8q-4pjq-4r52)
• Breaking: Changed the meeting end callback URL signature (callbacks for already running meetings fail, but the server poll detects that the meeting has ended within a minute) (GHSA-f7w5-8x3r-fmrf)
• Pass the meeting end callback to BigBlueButton as meetingEndedURL instead of the endCallbackUrl meta parameter (GHSA-mg6m-xfw5-h98w)
• Force download and strict CSP for user-uploaded files to prevent stored XSS (GHSA-597h-vmjv-9494)
• Encrypt sensitive data in queued notifications; existing password reset links are invalidated during the upgrade (GHSA-74cm-rg6m-4g87)
• Only accept requests for the exact host of APP_URL to prevent host header injection (GHSA-m8w4-4h4c-mpp3)

Full Changelog: v4.19.0...v4.20.0