Blog

Blesta 5.9.3 Patch Released

February 21, 2024 | Posted by Paul


We are pleased to announce the released of Blesta 5.9.3, which addresses bugs discovered in the 5.9 branch. A big thanks to everyone who participated in helping to make Blesta better by reporting and confirming bugs on our forums and discord chat, we appreciate your help!

The release notes are available at https://docs.blesta.com/display/support/5.9.3.

Always run /admin/upgrade in your browser or via CLI after updating the files for your installation. Patch releases may only be applied to the minor release to which it belongs. Only apply this patch if you are running 5.9.0, 5.9.1, or 5.9.2. If you are running an earlier version, you must download the full release.

Download 5.9.3 Patch Download 5.9.3 Full

SHA256 Sum

% blesta-5.9.3.zip
bfed233dfcc2883a6c4408e1b4d8f20b771af07eb0e67dc8b8fa795dd96e68a6

% blesta-5.9.0-5.9.3.zip
a851746218377c6e9ca0be76471a8d6a7f92c8156ff9d75d53a00355f398466c

To patch your installation, please follow the instructions for Patching an Existing Install from our user manual.

Security Advisory

February 8, 2024 | Posted by Paul


Several security issues affecting Blesta versions 5.0.0 through 5.9.1 have been identified. There is no evidence to suggest that these vulnerabilities are publicly known or being exploited, but you should take action now.

A path traversal vulnerability may lead to account compromise and RCE (Remote Code Execution) through vulnerability chaining. We recommend applying the appropriate patch for your release as soon as possible, or by upgrading to version 5.9.2. Given the compounding nature of these vulnerabilies, we give this an impact rating of Critical.

More information about how we rate vulnerabilities can be found on our Security Advisories page.

Always run /admin/upgrade in your browser after patching or upgrading your installation. Patch releases may only be applied to the minor release to which it belongs, so download the appropriate patch for your minor version. If you are running a version of Blesta between 5.0 and 5.6, upgrade to 5.9.2.

Downloads

Download 5.9.2 Patch Download 5.9.2 Full

% blesta-5.9.2.zip
27f59fd3bc7a30dd6dc40ae619447fc5be049f2f3cd811ac5a6fc59b6d643b02

% blesta-5.9.0-5.9.2.zip
a4626ab2a8fe3f28010c368cc54b704cade6ac2fc299b7d48a3daec3ef9837e3

Download 5.8.3 Patch

% blesta-5.8.0-5.8.3.zip
5f5463e8590b837c76b1aa1c3f89b07e50efce477606b8f6b7f49543b2e9e828

Download 5.7.2 Patch

% blesta-5.7.0-5.7.2.zip
3f06d2a2a08f196725389e69db0cc3dc1ac05ba48f3a473b01ecc3d2caa3fa8f

To patch your installation, please follow the instructions for Patching an Existing Install from our user manual.

Resolution

  • If you are running version 5.7.x, apply the 5.7.2 patch above.
  • If you are running version 5.8.x, apply the 5.8.3 patch above.
  • If you are running version 5.9.x, apply the 5.9.2 patch above.
  • If you are running version 5.0.x through 5.6.x, upgrade to 5.9.2 Full.

Mitigation

It is best to upgrade to 5.9.2 or apply the appropriate patch. However, if you are running an affected unsupported version of Blesta (version 5.0 through 5.6), or you need more time to upgrade, you may take the following immediate steps to mitigate.

  • Visit Settings > System > General and note the location of your “Uploads Directory”.
  • Assuming your uploads directory is “/path/to/uploads/” check the directory for your company ID (typically “1”) and see if you have a “themes” directory. If the directory exists, delete the directory. Example locations for this directory are: “/path/to/uploads/1/themes”, “/path/to/uploads/2/themes”, etc. Only users with addon-companies will have any directories other than “1” within the uploads directory. Ensure “themes” is deleted from each.

If your logo dissappears, you may need to visit Settings > Company > Look and Feel > Customize and set your logo using “Set Logo URL”, not “Upload Logo”. NOTE that this may result in the “themes” directory being re-created. If you perform this step, check for and delete the “themes” directory again.

We would also highly recommend ensuring that Two-Factor Authentication is enabled for all Staff accounts. Staff can set up Two-Factor Authentication under “My Info” using a token like Google Authenticator (for iOS/Android).

Credits

These issues were reported to us by Emre Hampolat in accordance with our Responsible Disclosure Policy.

Blesta 5.9.1 Patch Released

January 25, 2024 | Posted by Paul


We are pleased to announce the released of Blesta 5.9.1, which addresses bugs discovered in the 5.9 branch. A big thanks to everyone who participated in helping to make Blesta better by reporting and confirming bugs on our forums and discord chat, we appreciate your help!

The release notes are available at https://docs.blesta.com/display/support/5.9.1.

Always run /admin/upgrade in your browser or via CLI after updating the files for your installation. Patch releases may only be applied to the minor release to which it belongs. Only apply this patch if you are running 5.9.0. If you are running an earlier version, you must download the full release.

Download 5.9.1 Patch Download 5.9.1 Full

SHA256 Sum

% blesta-5.9.1.zip
90706ef493651791ac0fe43ef503f20010a7e260bc045d21df1e7d8c9edeb832

% blesta-5.9.0-5.9.1.zip
f75e9b4237d8ce341ec04ea6aa53b12e9f146fcec383974e3b2eedb9197b8879

To patch your installation, please follow the instructions for Patching an Existing Install from our user manual.

Blesta 5.8.2 Patch Released

October 19, 2023 | Posted by Paul


We are pleased to announce the released of Blesta 5.8.2, which addresses bugs discovered in the 5.8 branch. A big thanks to everyone who participated in helping to make Blesta better by reporting and confirming bugs on our forums and discord chat, we appreciate your help!

The release notes are available at https://docs.blesta.com/display/support/5.8.2.

Always run /admin/upgrade in your browser or via CLI after updating the files for your installation. Patch releases may only be applied to the minor release to which it belongs. Only apply this patch if you are running 5.8.0 or 5.8.1. If you are running an earlier version, you must download the full release.

Download 5.8.2 Patch Download 5.8.2 Full

SHA256 Sum

% blesta-5.8.2.zip
573b33ad6388aa76b2980a8f1ddff026877bfbb12deeb037584e3391fd5adee9

% blesta-5.8.0-5.8.2.zip
aa9ebc48d152818c295136d576b59f17f4ea950c1afaa164352966ae0011713a

To patch your installation, please follow the instructions for Patching an Existing Install from our user manual.

Blesta 5.8.1 Patch Released

August 30, 2023 | Posted by Paul


We are pleased to announce the released of Blesta 5.8.1, which addresses bugs discovered in the 5.8 branch. A big thanks to everyone who participated in helping to make Blesta better by reporting and confirming bugs on our forums and discord chat, we appreciate your help!

The release notes are available at https://docs.blesta.com/display/support/5.8.1.

Always run /admin/upgrade in your browser or via CLI after updating the files for your installation. Patch releases may only be applied to the minor release to which it belongs. Only apply this patch if you are running 5.8.0. If you are running an earlier version, you must download the full release.

Download 5.8.1 Patch Download 5.8.1 Full

SHA256 Sum

% blesta-5.8.1.zip
ea9b0fd46a5bd90201bd08f7f2c63da95bf6c2a53343804cc33889ee6df71a95

% blesta-5.8.0-5.8.1.zip
3fef96bfde6d852e360ede727499801affc1b4abce963cf232f775f9b0799803

To patch your installation, please follow the instructions for Patching an Existing Install from our user manual.