themartz90/jellydash v1.15.3

on GitHub

v1.15.3 updates the Docker image from PHP 8.3.33 to PHP 8.3.36. Please update as soon as possible.

Security

PHP 8.3.36 fixes two critical vulnerabilities that can allow unauthenticated remote code execution:

• CVE-2026-109618: RCE via OOM corruption
• CVE-2026-109619: RCE via stale global state

Jellydash's Docker image uses Apache mod_php, which PHP identifies as the highest-risk configuration. An attack can occur before application code runs, so Jellydash's login does not protect against these PHP vulnerabilities.

The PHP base image is pinned to the verified 8.3.36 multi-platform digest for AMD64 and ARM64. See the PHP release announcement.

Updating

This release adds no database migration or required application settings.

For Compose installations using a rolling image tag:

docker compose pull && docker compose up -d

If you pin the image version, change it to ghcr.io/themartz90/jellydash:1.15.3 before running those commands. On Unraid, use the normal container update. Pulling the image alone does not update an existing container; it must be recreated.

Installations running PHP directly must update their PHP runtime separately. Updating Jellydash's application files does not update the host's PHP installation.