BlueSpice Helpdesk - User contributions [en]

Security:Security Advisories/BSSA-2026-09

2026-11-06T07:02:58Z

Rvogel1:

{{Textbox|boxtype=important|icon=yes|header=Update 2026-11-06|text=This advisory was corrected and extended:
* Not all containers were rebuilt for BlueSpice 5.1.11.2 and 5.2.7.2 on 2026-10-30. The rebuilt images of <code>wire</code>, <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>frontendcache</code> and <code>kerberosproxy</code> were published on 2026-11-04. <code>collabpads</code>, <code>proxy</code> and <code>database</code> have not been rebuilt yet. Their risk stays '''low'''. See "Fixed in" and "Solution".
* New section on Ghostscript (container <code>bluespice/wiki</code>, all editions): Ghostscript contains its own copy of the Brotli library. According to our analysis, this copy already contains the fix. Security scanners may still report it. As a precaution, we recommend disabling the extension PdfHandler. Risk: '''low'''. See [[#Precaution: disable PdfHandler (all editions)|below]].
* CVE-2026-115557: the container <code>bluespice/ai</code> is now also fixed in BlueSpice 5.2.7.2 (published on 2026-11-06), earlier than announced (5.2.8). After the update, the AI service no longer needs to be disabled.
}}

{| class="wikitable"
|+
!
!
|-
|Date
|2026-10-29 (updated 2026-11-06)
|-
|Severity
|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers, and Ghostscript in container <code>bluespice/wiki</code> in all editions)<br />
CVE-2026-115557: reported "critical" (CVSS 4.0: 9.4), BlueSpice assessment: '''medium''' (containers <code>bluespice/ai</code> and <code>bluespice/chat</code>), not affected (all other containers)
|-
|Affected
|
* Container <code>bluespice/wiki</code> in BlueSpice pro and farm 5.1 up to 5.1.11.1 and 5.2 up to 5.2.7.1
* Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the MS Teams integration is used
* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration
* Ghostscript in container <code>bluespice/wiki</code> (all editions, all versions up to 5.1.11.2 and 5.2.7.2): own copy of the Brotli library, which most likely already contains the fix (precaution)
* CVE-2026-115557: Container <code>bluespice/ai</code> in BlueSpice 5.2 up to 5.2.7.1, if the AI service is used
* CVE-2026-115557 (same issue in Node.js, no own CVE): Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the chat service is used
|-
|Fixed in
|
* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2:
** containers <code>bluespice/wiki</code> (all editions) and <code>chat</code> (5.2 only): published on 2026-10-30
** containers <code>wire</code> (5.2 only), <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>kerberosproxy</code> (5.1 and 5.2) and <code>frontendcache</code> (5.2): published on 2026-11-04
**  containers <code>collabpads</code>, <code>proxy</code> and <code>database</code>: not rebuilt yet (risk: low)
** Ghostscript in container <code>bluespice/wiki</code>: no update available; precaution see below
* CVE-2026-115557: BlueSpice 5.2.7.2 (container <code>bluespice/chat</code>: published on 2026-10-30; container <code>bluespice/ai</code>: published on 2026-11-06)
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-111497 CVE-2026-111497]
* [https://www.cve.org/CVERecord?id=CVE-2026-115557 CVE-2026-115557]
|}

==Problem==
'''CVE-2026-111497:''' A vulnerability in the Brotli decompression library (publicly known as "Node2Shell") allows an attacker to write beyond a memory buffer by sending specially crafted compressed data. This can crash the program, reveal memory contents and allow the attacker to run code. The library is used by Node.js and by many Linux programs, e.g. the <code>curl</code> library that PHP uses for outgoing HTTP requests. Public exploit code exists for Node.js applications and for PHP applications that download data from web addresses. The US authority CISA lists the vulnerability as actively exploited.

'''CVE-2026-115557:''' The private keys of several intermediate certificates of the certificate authority eMudhra were generated incorrectly and are publicly known. Anyone can create certificates for any website with them. Browsers already block these certificates, but many programs that check certificates only against a list of trusted root certificates still accept them. Python and Node.js, which the AI service and the chat service use, were updated to block them. Older Python versions are safe if their list of trusted root certificates is up to date.

{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-111497
|Brotli library (container <code>bluespice/wiki</code> in BlueSpice pro and farm)
|Out-of-bounds write when decompressing data, remote code execution
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-111497
|Node.js (container <code>bluespice/chat</code>)
|Out-of-bounds write when decompressing data, possibly remote code execution
| style="" class="col-orange-bg" |affected, if MS Teams integration is used
|-
|CVE-2026-111497
|Brotli library / Node.js (other containers)
|Out-of-bounds write when decompressing data
| style="" class="col-green-bg" |not exploitable
|-
|CVE-2026-111497
|Ghostscript (container <code>bluespice/wiki</code>, all editions)
|Out-of-bounds write when decompressing data
| style="" class="col-green-bg" |most likely fixed, precaution recommended
|-
|CVE-2026-115557
|Python (container <code>bluespice/ai</code>)
|Forged server certificates are accepted for outgoing connections
| style="" class="col-orange-bg" |affected, if the AI service is used
|-
|CVE-2026-115557 (same issue in Node.js)
|Node.js (container <code>bluespice/chat</code>)
|Forged server certificates are accepted for outgoing connections
| style="" class="col-orange-bg" |affected, if the chat service is used
|-
|CVE-2026-115557
|Python / Node.js / Java (other containers)
|Forged server certificates are accepted for outgoing connections
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!Component
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/wiki</code> (BlueSpice pro and farm)
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |'''Critical''' on publicly readable wikis, high on wikis that require a login. The extensions ExternalData (BlueSpice 5.1 and 5.2) and ExternalContent (BlueSpice 5.2) let users load data from any web address into a page. The wiki decompresses this data with the affected library. An attacker who controls a web server can use this to run commands in the wiki container. Public exploit code shows this for a comparable PHP application.

Unlike the PHP vulnerabilities in [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]], network access to the wiki is not enough. The attacker needs '''read access to the wiki''' itself. On wikis that require a login, only logged-in users can exploit the vulnerability. The main risk is on publicly readable wikis, where no login is needed. Such wikis are rare among BlueSpice installations. In addition, the wiki must be able to connect to the attacker's server on the internet.
| style="vertical-align:middle;text-align:left;" |Disable the extensions ExternalData and ExternalContent (see below).
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/chat</code>
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |'''Medium'''. The chat service is not part of standard installations. Its MS Teams connector decompresses incoming requests before it checks whether they come from Microsoft. This connector is not reachable from outside in the default configuration of <code>bluespice-deploy</code>. If you have made it reachable for MS Teams, the risk is high: an attacker without login could possibly run code in the chat container.
| style="vertical-align:middle;text-align:left;" |Do not expose the MS Teams connector, or reject requests with the header <code>Content-Encoding: br</code> in the reverse proxy in front of it.
|-
| style="vertical-align:middle;text-align:left;" |All other containers, including <code>bluespice/wiki</code> in BlueSpice free
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration. The same applies to the third-party image <code>mongo:8.2</code>, which <code>bluespice-deploy</code> uses for the database of the <code>collabpads</code> service.
| style="vertical-align:middle;text-align:left;" |None required. Update with the next maintenance.
|-
| style="vertical-align:middle;text-align:left;" |Ghostscript in container <code>bluespice/wiki</code> (all editions)
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. The wiki uses Ghostscript to create preview images of uploaded PDF files. Ghostscript contains its own copy of the Brotli library. According to our analysis of the source code, this copy already contains the fix, but it still reports the old version number. Security scanners may therefore report it as affected. We could not fully verify the compiled program and know of no exploit code for Ghostscript. An attack would require a user who is allowed to upload files. Usually only logged-in users with edit rights can do this, also on publicly readable wikis.
| style="vertical-align:middle;text-align:left;" |As a precaution, disable the extension PdfHandler (see below).
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/ai</code> (CVE-2026-115557)
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |'''Medium'''. The AI service is not part of standard installations. It sends questions, wiki content and the API key of the AI provider (e.g. Azure OpenAI, OpenAI, Google, IONOS) over encrypted connections. It still accepts the forged certificates. An attacker who can intercept and redirect the network traffic between your server and the AI provider can read the API key and the wiki content and change the answers. Access to the wiki is not required. However, the attacker must control the network path, e.g. a router, DNS or proxy server between your server and the AI provider. This makes an attack difficult. We do not know of any attacks.
| style="vertical-align:middle;text-align:left;" |Update to BlueSpice 5.2.7.2. If you cannot update, disable the AI service: set <code>AI=false</code> in the <code>.env</code> file and run <code>./bluespice-deploy up -d --remove-orphans</code>. The AI features of the wiki and the chat are not available until then.
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/chat</code> (CVE-2026-115557, same issue in Node.js)
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |'''Medium'''. Same issue as for the AI service. The chat service accepts the forged certificates on its connections to MS Teams or Slack. An attacker who controls the network path can read and change chat messages and read the access credentials of the connector.
| style="vertical-align:middle;text-align:left;" |None. Update to BlueSpice 5.2.7.2, or disable the chat service.
|-
| style="vertical-align:middle;text-align:left;" |All other containers (CVE-2026-115557)
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Not affected'''. <code>bluespice/wiki</code> and <code>bluespice/search</code> contain Python, but either already reject the forged certificates or make no outgoing connections. The same applies to Node.js and Java in the other containers.
| style="vertical-align:middle;text-align:left;" |None required.
|}

== Solution ==
Update to '''BlueSpice 5.2.7.2''' or '''BlueSpice 5.1.11.2'''. As with [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]], these are nano releases without functional changes. We recommend the update for <code>bluespice/wiki</code> in all editions (free, pro and farm). The containers listed under "Fixed in" were rebuilt with the fixed Brotli library (<code>brotli-libs 1.2.1</code>) and fixed Node.js versions. For these containers, the image tags <code>5</code>, <code>5.2</code> and <code>5.1</code> point to the fixed images. <code>collabpads</code>, <code>proxy</code> and <code>database</code> will follow (risk: low). If you have already updated to 5.2.7.2 or 5.1.11.2 before 2026-11-04, run the update commands again to get the rebuilt service containers.

In the <code>.env</code> file of <code>bluespice-deploy</code>, set <code>VERSION</code> to <code>5.2</code> or <code>5.1</code>. Then run these commands in the <code>compose</code> directory of <code>bluespice-deploy</code>: <code>./bluespice-deploy pull && ./bluespice-deploy up -d</code>. Use the <code>bluespice-deploy</code> script instead of plain <code>docker compose</code>, because only the script loads all required <code>docker-compose.*.yml</code> files.

To check whether your installation is fixed, run:
* <code>./bluespice-deploy exec wiki-web apk info -v brotli-libs</code> and <code>./bluespice-deploy exec wiki-task apk info -v brotli-libs</code>: must show <code>brotli-libs-1.2.1-r0</code> or higher
* <code>./bluespice-deploy exec chat node -v</code> (BlueSpice 5.2, only if the chat service is used): must show <code>v24.22.1</code> or higher
* <code>./bluespice-deploy exec ai python3 -V</code> (BlueSpice 5.2, only if the AI service is used): must show <code>Python 3.12.16</code> or higher

The fixed image of <code>bluespice/ai</code> was published on 2026-11-06. If you have already updated to 5.2.7.2 before that date and use the AI service, run the update commands again. If you disabled the AI service because of this advisory, you can enable it again after the update (<code>AI=true</code> in the <code>.env</code> file, then <code>./bluespice-deploy up -d</code>).

=== Mitigation without update: disable ExternalData and ExternalContent (BlueSpice pro and farm) ===
Use the same method as in [[Security:Security Advisories/BSSA-2026-06#Mitigation:_disable_Extension:ExternalData|BSSA-2026-06]]: mount a copy of the settings file in which the extensions are not loaded. In BlueSpice 5.1, the command only finds ExternalData, as ExternalContent is not part of 5.1.
<syntaxhighlight lang="bash">
./bluespice-deploy cp wiki-web:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php ./
sed -i -E "s/^(wfLoadExtension$ 'External(Data|Content)' $;)/#\1/" 040-BlueSpiceProDistribution.php
</syntaxhighlight>
Add the file to <code>docker-compose.override.yml</code>:
<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>
Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version.
{{Textbox|boxtype=warning|icon=yes|header=Remove the mount when you update|text=Remove the mount before or together with the update. Otherwise the copied file of the old version replaces the file of the new version.}}

While the extensions are disabled, pages that use them show the parser functions as plain text or no data. No content is lost.

=== Precaution: disable PdfHandler (all editions) ===
The extension PdfHandler creates preview images of uploaded PDF files with Ghostscript. Ghostscript contains its own copy of the Brotli library and does not use the system library <code>brotli-libs</code>. The update to 5.2.7.2 or 5.1.11.2 therefore does not change it. According to our analysis, this copy already contains the fix (see "Impact assessment"). Because we cannot fully verify this, we recommend disabling PdfHandler as a precaution until an updated Ghostscript is available.

Use the same method as above with the file <code>030-BlueSpiceFreeDistribution.php</code>:
<syntaxhighlight lang="bash">
./bluespice-deploy cp wiki-web:/app/bluespice/w/settings.d/030-BlueSpiceFreeDistribution.php ./
sed -i -E "s/^(wfLoadExtension$ 'PdfHandler' $;)/#\1/" 030-BlueSpiceFreeDistribution.php
grep -n "PdfHandler" 030-BlueSpiceFreeDistribution.php
</syntaxhighlight>
The last command must show <code>#wfLoadExtension( 'PdfHandler' );</code>. Add the file to <code>docker-compose.override.yml</code>:
<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./030-BlueSpiceFreeDistribution.php:/app/bluespice/w/settings.d/030-BlueSpiceFreeDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>
If you also disable ExternalData and ExternalContent, add both files to the <code>volumes</code> list. Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version. We will announce here when an updated Ghostscript is available.
{{Textbox|boxtype=warning|icon=yes|header=Remove the mount when you update|text=Remove the mount before or together with the next update. Otherwise the copied file of the old version replaces the file of the new version.}}

While PdfHandler is disabled, PDF files can still be uploaded and downloaded. The wiki does not create new preview images for them and shows a file icon instead. No content is lost.

=== Was my installation compromised? ===
We do not know of any attacks on BlueSpice installations. The vulnerability has been public since 2026-10-21. Public exploit code for a comparable PHP application exists since 2026-10-28.

Installing the update or disabling the extensions stops further exploitation. It does not remove anything an attacker may have left behind. If your wiki uses BlueSpice pro or farm and could connect to servers on the internet, check:
# '''Pages, templates and modules''' with <code><nowiki>{{#get_web_data}}</nowiki></code>, <code><nowiki>{{#get_external_data}}</nowiki></code> or <code><nowiki>{{#embed}}</nowiki></code> that point to servers you do not know, and modules that use <code>mw.ext.externalData</code>.
# '''The access log of the reverse proxy''' for requests to <code>api.php</code> or <code>index.php</code> with these functions. They can also be used without saving a page, e.g. in a preview. See the notes on log analysis in [[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]].
# '''The logs of <code>wiki-web</code> and <code>wiki-task</code>''' for processes that ended with a segmentation fault (e.g. <code>exited on signal 11</code>), and, if available, your firewall logs for connections from the wiki to unknown servers.

If you find signs of an attack, follow the procedure in [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]] (section "Was my installation compromised?") and contact the Hallo Welt! GmbH support.

=== BlueSpice cloud ===


BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH, including the AI service. No action is required from cloud customers.

Security:Security Advisories/BSSA-2026-09

2026-11-05T15:12:23Z

Rvogel1:

'''Update 2026-11-05:''' This advisory was corrected:
* Not all containers were rebuilt for BlueSpice 5.1.11.2 and 5.2.7.2 on 2026-10-30. The rebuilt images of <code>chat</code>, <code>wire</code>, <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>frontendcache</code> and <code>kerberosproxy</code> were published on 2026-11-04. <code>collabpads</code>, <code>proxy</code> and <code>database</code> have not been rebuilt yet. Their risk stays '''low'''. See "Fixed in" and "Solution".
* New section on Ghostscript (container <code>bluespice/wiki</code>, all editions): Ghostscript contains its own copy of the Brotli library. According to our analysis, this copy already contains the fix. Security scanners may still report it. As a precaution, we recommend disabling the extension PdfHandler. Risk: '''low'''. See [[#Precaution: disable PdfHandler (all editions)|below]].

{| class="wikitable"
|+
!
!
|-
|Date
|2026-10-29 (updated 2026-11-05)
|-
|Severity
|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers, and Ghostscript in container <code>bluespice/wiki</code> in all editions)<br />
CVE-2026-115557: reported "critical" (CVSS 4.0: 9.4), BlueSpice assessment: '''medium''' (containers <code>bluespice/ai</code> and <code>bluespice/chat</code>), not affected (all other containers)
|-
|Affected
|
* Container <code>bluespice/wiki</code> in BlueSpice pro and farm 5.1 up to 5.1.11.1 and 5.2 up to 5.2.7.1
* Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the MS Teams integration is used
* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration
* Ghostscript in container <code>bluespice/wiki</code> (all editions, all versions up to 5.1.11.2 and 5.2.7.2): own copy of the Brotli library, which most likely already contains the fix (precaution)
* CVE-2026-115557: Container <code>bluespice/ai</code> in BlueSpice 5.2 before 5.2.8, if the AI service is used
* CVE-2026-115557 (same issue in Node.js, no own CVE): Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the chat service is used
|-
|Fixed in
|
* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2:
** container <code>bluespice/wiki</code> (all editions): published on 2026-10-30
** containers <code>chat</code> and <code>wire</code> (5.2 only), <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>kerberosproxy</code> (5.1 and 5.2) and <code>frontendcache</code> (5.2): published on 2026-11-04
**  containers <code>collabpads</code>, <code>proxy</code> and <code>database</code>: not rebuilt yet (risk: low)
** Ghostscript in container <code>bluespice/wiki</code>: no update available; precaution see below
* CVE-2026-115557: BlueSpice 5.2.7.2 (container <code>bluespice/chat</code>); BlueSpice 5.2.8 (container <code>bluespice/ai</code>, next regular release)
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-111497 CVE-2026-111497]
* [https://www.cve.org/CVERecord?id=CVE-2026-115557 CVE-2026-115557]
|}

==Problem==
'''CVE-2026-111497:''' A vulnerability in the Brotli decompression library (publicly known as "Node2Shell") allows an attacker to write beyond a memory buffer by sending specially crafted compressed data. This can crash the program, reveal memory contents and allow the attacker to run code. The library is used by Node.js and by many Linux programs, e.g. the <code>curl</code> library that PHP uses for outgoing HTTP requests. Public exploit code exists for Node.js applications and for PHP applications that download data from web addresses. The US authority CISA lists the vulnerability as actively exploited.

'''CVE-2026-115557:''' The private keys of several intermediate certificates of the certificate authority eMudhra were generated incorrectly and are publicly known. Anyone can create certificates for any website with them. Browsers already block these certificates, but many programs that check certificates only against a list of trusted root certificates still accept them. Python and Node.js, which the AI service and the chat service use, were updated to block them. Older Python versions are safe if their list of trusted root certificates is up to date.

{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-111497
|Brotli library (container <code>bluespice/wiki</code> in BlueSpice pro and farm)
|Out-of-bounds write when decompressing data, remote code execution
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-111497
|Node.js (container <code>bluespice/chat</code>)
|Out-of-bounds write when decompressing data, possibly remote code execution
| style="" class="col-orange-bg" |affected, if MS Teams integration is used
|-
|CVE-2026-111497
|Brotli library / Node.js (other containers)
|Out-of-bounds write when decompressing data
| style="" class="col-green-bg" |not exploitable
|-
|CVE-2026-111497
|Ghostscript (container <code>bluespice/wiki</code>, all editions)
|Out-of-bounds write when decompressing data
| style="" class="col-green-bg" |most likely fixed, precaution recommended
|-
|CVE-2026-115557
|Python (container <code>bluespice/ai</code>)
|Forged server certificates are accepted for outgoing connections
| style="" class="col-orange-bg" |affected, if the AI service is used
|-
|CVE-2026-115557 (same issue in Node.js)
|Node.js (container <code>bluespice/chat</code>)
|Forged server certificates are accepted for outgoing connections
| style="" class="col-orange-bg" |affected, if the chat service is used
|-
|CVE-2026-115557
|Python / Node.js / Java (other containers)
|Forged server certificates are accepted for outgoing connections
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!Component
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/wiki</code> (BlueSpice pro and farm)
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |'''Critical''' on publicly readable wikis, high on wikis that require a login. The extensions ExternalData (BlueSpice 5.1 and 5.2) and ExternalContent (BlueSpice 5.2) let users load data from any web address into a page. The wiki decompresses this data with the affected library. An attacker who controls a web server can use this to run commands in the wiki container. Public exploit code shows this for a comparable PHP application.

Unlike the PHP vulnerabilities in [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]], network access to the wiki is not enough. The attacker needs '''read access to the wiki''' itself. On wikis that require a login, only logged-in users can exploit the vulnerability. The main risk is on publicly readable wikis, where no login is needed. Such wikis are rare among BlueSpice installations. In addition, the wiki must be able to connect to the attacker's server on the internet.
| style="vertical-align:middle;text-align:left;" |Disable the extensions ExternalData and ExternalContent (see below).
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/chat</code>
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |'''Medium'''. The chat service is not part of standard installations. Its MS Teams connector decompresses incoming requests before it checks whether they come from Microsoft. This connector is not reachable from outside in the default configuration of <code>bluespice-deploy</code>. If you have made it reachable for MS Teams, the risk is high: an attacker without login could possibly run code in the chat container.
| style="vertical-align:middle;text-align:left;" |Do not expose the MS Teams connector, or reject requests with the header <code>Content-Encoding: br</code> in the reverse proxy in front of it.
|-
| style="vertical-align:middle;text-align:left;" |All other containers, including <code>bluespice/wiki</code> in BlueSpice free
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration. The same applies to the third-party image <code>mongo:8.2</code>, which <code>bluespice-deploy</code> uses for the database of the <code>collabpads</code> service.
| style="vertical-align:middle;text-align:left;" |None required. Update with the next maintenance.
|-
| style="vertical-align:middle;text-align:left;" |Ghostscript in container <code>bluespice/wiki</code> (all editions)
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. The wiki uses Ghostscript to create preview images of uploaded PDF files. Ghostscript contains its own copy of the Brotli library. According to our analysis of the source code, this copy already contains the fix, but it still reports the old version number. Security scanners may therefore report it as affected. We could not fully verify the compiled program and know of no exploit code for Ghostscript. An attack would require a user who is allowed to upload files. Usually only logged-in users with edit rights can do this, also on publicly readable wikis.
| style="vertical-align:middle;text-align:left;" |As a precaution, disable the extension PdfHandler (see below).
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/ai</code> (CVE-2026-115557)
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |'''Medium'''. The AI service is not part of standard installations. It sends questions, wiki content and the API key of the AI provider (e.g. Azure OpenAI, OpenAI, Google, IONOS) over encrypted connections. It still accepts the forged certificates. An attacker who can intercept and redirect the network traffic between your server and the AI provider can read the API key and the wiki content and change the answers. Access to the wiki is not required. However, the attacker must control the network path, e.g. a router, DNS or proxy server between your server and the AI provider. This makes an attack difficult. We do not know of any attacks.
| style="vertical-align:middle;text-align:left;" |Disable the AI service until BlueSpice 5.2.8: set <code>AI=false</code> in the <code>.env</code> file and run <code>./bluespice-deploy up -d --remove-orphans</code>. The AI features of the wiki and the chat are not available until then.
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/chat</code> (CVE-2026-115557, same issue in Node.js)
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |'''Medium'''. Same issue as for the AI service. The chat service accepts the forged certificates on its connections to MS Teams or Slack. An attacker who controls the network path can read and change chat messages and read the access credentials of the connector.
| style="vertical-align:middle;text-align:left;" |None. Update to BlueSpice 5.2.7.2, or disable the chat service.
|-
| style="vertical-align:middle;text-align:left;" |All other containers (CVE-2026-115557)
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Not affected'''. <code>bluespice/wiki</code> and <code>bluespice/search</code> contain Python, but either already reject the forged certificates or make no outgoing connections. The same applies to Node.js and Java in the other containers.
| style="vertical-align:middle;text-align:left;" |None required.
|}

== Solution ==
Update to '''BlueSpice 5.2.7.2''' or '''BlueSpice 5.1.11.2'''. As with [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]], these are nano releases without functional changes. We recommend the update for <code>bluespice/wiki</code> in all editions (free, pro and farm). The containers listed under "Fixed in" were rebuilt with the fixed Brotli library (<code>brotli-libs 1.2.1</code>) and fixed Node.js versions. For these containers, the image tags <code>5</code>, <code>5.2</code> and <code>5.1</code> point to the fixed images. <code>collabpads</code>, <code>proxy</code> and <code>database</code> will follow (risk: low). If you have already updated to 5.2.7.2 or 5.1.11.2 before 2026-11-04, run the update commands again to get the rebuilt service containers.

In the <code>.env</code> file of <code>bluespice-deploy</code>, set <code>VERSION</code> to <code>5.2</code> or <code>5.1</code>. Then run these commands in the <code>compose</code> directory of <code>bluespice-deploy</code>: <code>./bluespice-deploy pull && ./bluespice-deploy up -d</code>. Use the <code>bluespice-deploy</code> script instead of plain <code>docker compose</code>, because only the script loads all required <code>docker-compose.*.yml</code> files.

To check whether your installation is fixed, run:
* <code>./bluespice-deploy exec wiki-web apk info -v brotli-libs</code> and <code>./bluespice-deploy exec wiki-task apk info -v brotli-libs</code>: must show <code>brotli-libs-1.2.1-r0</code> or higher
* <code>./bluespice-deploy exec chat node -v</code> (BlueSpice 5.2, only if the chat service is used): must show <code>v24.22.1</code> or higher

The container <code>bluespice/ai</code> was '''not''' rebuilt for BlueSpice 5.2.7.2. It will be fixed in BlueSpice 5.2.8. Until then, disable the AI service as described in the table above, if you use it.

=== Mitigation without update: disable ExternalData and ExternalContent (BlueSpice pro and farm) ===
Use the same method as in [[Security:Security Advisories/BSSA-2026-06#Mitigation:_disable_Extension:ExternalData|BSSA-2026-06]]: mount a copy of the settings file in which the extensions are not loaded. In BlueSpice 5.1, the command only finds ExternalData, as ExternalContent is not part of 5.1.
<syntaxhighlight lang="bash">
./bluespice-deploy cp wiki-web:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php ./
sed -i -E "s/^(wfLoadExtension$ 'External(Data|Content)' $;)/#\1/" 040-BlueSpiceProDistribution.php
</syntaxhighlight>
Add the file to <code>docker-compose.override.yml</code>:
<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>
Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version. '''Remove the mount before or together with the update.'''

While the extensions are disabled, pages that use them show the parser functions as plain text or no data. No content is lost.

=== Precaution: disable PdfHandler (all editions) ===
The extension PdfHandler creates preview images of uploaded PDF files with Ghostscript. Ghostscript contains its own copy of the Brotli library and does not use the system library <code>brotli-libs</code>. The update to 5.2.7.2 or 5.1.11.2 therefore does not change it. According to our analysis, this copy already contains the fix (see "Impact assessment"). Because we cannot fully verify this, we recommend disabling PdfHandler as a precaution until an updated Ghostscript is available.

Use the same method as above with the file <code>030-BlueSpiceFreeDistribution.php</code>:
<syntaxhighlight lang="bash">
./bluespice-deploy cp wiki-web:/app/bluespice/w/settings.d/030-BlueSpiceFreeDistribution.php ./
sed -i -E "s/^(wfLoadExtension$ 'PdfHandler' $;)/#\1/" 030-BlueSpiceFreeDistribution.php
grep -n "PdfHandler" 030-BlueSpiceFreeDistribution.php
</syntaxhighlight>
The last command must show <code>#wfLoadExtension( 'PdfHandler' );</code>. Add the file to <code>docker-compose.override.yml</code>:
<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./030-BlueSpiceFreeDistribution.php:/app/bluespice/w/settings.d/030-BlueSpiceFreeDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>
If you also disable ExternalData and ExternalContent, add both files to the <code>volumes</code> list. Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version. '''Remove the mount before or together with the next update.''' We will announce here when an updated Ghostscript is available.

While PdfHandler is disabled, PDF files can still be uploaded and downloaded. The wiki does not create new preview images for them and shows a file icon instead. No content is lost.

=== Was my installation compromised? ===
We do not know of any attacks on BlueSpice installations. The vulnerability has been public since 2026-10-21. Public exploit code for a comparable PHP application exists since 2026-10-28.

Installing the update or disabling the extensions stops further exploitation. It does not remove anything an attacker may have left behind. If your wiki uses BlueSpice pro or farm and could connect to servers on the internet, check:
# '''Pages, templates and modules''' with <code><nowiki>{{#get_web_data}}</nowiki></code>, <code><nowiki>{{#get_external_data}}</nowiki></code> or <code><nowiki>{{#embed}}</nowiki></code> that point to servers you do not know, and modules that use <code>mw.ext.externalData</code>.
# '''The access log of the reverse proxy''' for requests to <code>api.php</code> or <code>index.php</code> with these functions. They can also be used without saving a page, e.g. in a preview. See the notes on log analysis in [[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]].
# '''The logs of <code>wiki-web</code> and <code>wiki-task</code>''' for processes that ended with a segmentation fault (e.g. <code>exited on signal 11</code>), and, if available, your firewall logs for connections from the wiki to unknown servers.

If you find signs of an attack, follow the procedure in [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]] (section "Was my installation compromised?") and contact the Hallo Welt! GmbH support.

=== BlueSpice cloud ===


BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH, including the AI service. No action is required from cloud customers.⏎

Security:Security Advisories/BSSA-2026-09

2026-10-30T12:57:06Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-10-29
|-
|Severity
|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers)<br />
CVE-2026-115557: reported "critical" (CVSS 4.0: 9.4), BlueSpice assessment: '''medium''' (containers <code>bluespice/ai</code> and <code>bluespice/chat</code>), not affected (all other containers)
|-
|Affected
|
* Container <code>bluespice/wiki</code> in BlueSpice pro and farm 5.1 up to 5.1.11.1 and 5.2 up to 5.2.7.1
* Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the MS Teams integration is used
* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration
* CVE-2026-115557: Container <code>bluespice/ai</code> in BlueSpice 5.2 before 5.2.8, if the AI service is used
* CVE-2026-115557 (same issue in Node.js, no own CVE): Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the chat service is used
|-
|Fixed in
|

* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2 (all containers rebuilt with the fixed Brotli library and Node.js versions, published on <date>)
* CVE-2026-115557: BlueSpice 5.2.7.2 (container <code>bluespice/chat</code>); BlueSpice 5.2.8 (container <code>bluespice/ai</code>, next regular release)
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-111497 CVE-2026-111497]
* [https://www.cve.org/CVERecord?id=CVE-2026-115557 CVE-2026-115557]
|}

==Problem==
A vulnerability in the Brotli decompression library (publicly known as "Node2Shell") allows an attacker to write beyond a memory buffer by sending specially crafted compressed data. This can crash the program, reveal memory contents and allow the attacker to run code. The library is used by Node.js and by many Linux programs, e.g. the <code>curl</code> library that PHP uses for outgoing HTTP requests. Public exploit code exists for Node.js applications and for PHP applications that download data from web addresses. The US authority CISA lists the vulnerability as actively exploited.

'''CVE-2026-115557:''' The private keys of several intermediate certificates of the certificate authority eMudhra were generated incorrectly and are publicly known. Anyone can create certificates for any website with them. Browsers already block these certificates, but many programs that check certificates only against a list of trusted root certificates still accept them. Python and Node.js, which the AI service and the chat service use, were updated to block them. Older Python versions are safe if their list of trusted root certificates is up to date.

{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-111497
|Brotli library (container <code>bluespice/wiki</code> in BlueSpice pro and farm)
|Out-of-bounds write when decompressing data, remote code execution
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-111497
|Node.js (container <code>bluespice/chat</code>)
|Out-of-bounds write when decompressing data, possibly remote code execution
| style="" class="col-orange-bg" |affected, if MS Teams integration is used
|-
|CVE-2026-111497
|Brotli library / Node.js (other containers)
|Out-of-bounds write when decompressing data
| style="" class="col-green-bg" |not exploitable
|-
|CVE-2026-115557
|Python (container <code>bluespice/ai</code>)
|Forged server certificates are accepted for outgoing connections
| style="" class="col-orange-bg" |affected, if the AI service is used
|-
|CVE-2026-115557 (same issue in Node.js)
|Node.js (container <code>bluespice/chat</code>)
|Forged server certificates are accepted for outgoing connections
| style="" class="col-orange-bg" |affected, if the chat service is used
|-
|CVE-2026-115557
|Python / Node.js / Java (other containers)
|Forged server certificates are accepted for outgoing connections
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!Component
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/wiki</code> (BlueSpice pro and farm)
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |Critical on publicly readable wikis, high on wikis that require a login. The extensions ExternalData (BlueSpice 5.1 and 5.2) and ExternalContent (BlueSpice 5.2) let users load data from any web address into a page. The wiki decompresses this data with the affected library. An attacker who controls a web server can use this to run commands in the wiki container. Public exploit code shows this for a comparable PHP application.

Unlike the PHP vulnerabilities in [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]], network access to the wiki is not enough. The attacker needs '''read access to the wiki''' itself. On wikis that require a login, only logged-in users can exploit the vulnerability. The main risk is on publicly readable wikis, where no login is needed. Such wikis are rare among BlueSpice installations. In addition, the wiki must be able to connect to the attacker's server on the internet.
| style="vertical-align:middle;text-align:left;" |Disable the extensions ExternalData and ExternalContent (see below).
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/chat</code>
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Medium. The chat service is not part of standard installations. Its MS Teams connector decompresses incoming requests before it checks whether they come from Microsoft. This connector is not reachable from outside in the default configuration of <code>bluespice-deploy</code>. If you have made it reachable for MS Teams, the risk is high: an attacker without login could possibly run code in the chat container.
| style="vertical-align:middle;text-align:left;" |Do not expose the MS Teams connector, or reject requests with the header <code>Content-Encoding: br</code> in the reverse proxy in front of it.
|-
| style="vertical-align:middle;text-align:left;" |All other containers, including <code>bluespice/wiki</code> in BlueSpice free
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Low. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration.
| style="vertical-align:middle;text-align:left;" |None required. Update with the next maintenance.
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/ai</code> (CVE-2026-115557)
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Medium. The AI service is not part of standard installations. It sends questions, wiki content and the API key of the AI provider (e.g. Azure OpenAI, OpenAI, Google, IONOS) over encrypted connections. It still accepts the forged certificates. An attacker who can intercept and redirect the network traffic between your server and the AI provider can read the API key and the wiki content and change the answers. Access to the wiki is not required. However, the attacker must control the network path, e.g. a router, DNS or proxy server between your server and the AI provider. This makes an attack difficult. We do not know of any attacks.
| style="vertical-align:middle;text-align:left;" |Disable the AI service until BlueSpice 5.2.8: set <code>AI=false</code> in the <code>.env</code> file and run <code>./bluespice-deploy up -d --remove-orphans</code>. The AI features of the wiki and the chat are not available until then.
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/chat</code> (CVE-2026-115557, same issue in Node.js)
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Medium. Same issue as for the AI service. The chat service accepts the forged certificates on its connections to MS Teams or Slack. An attacker who controls the network path can read and change chat messages and read the access credentials of the connector.
| style="vertical-align:middle;text-align:left;" |None. Update to BlueSpice 5.2.7.2, or disable the chat service.
|-
| style="vertical-align:middle;text-align:left;" |All other containers (CVE-2026-115557)
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. <code>bluespice/wiki</code> and <code>bluespice/search</code> contain Python, but either already reject the forged certificates or make no outgoing connections. The same applies to Node.js and Java in the other containers.
| style="vertical-align:middle;text-align:left;" |None required.
|}

== Solution ==
Update to '''BlueSpice 5.2.7.2''' or '''BlueSpice 5.1.11.2'''. As with [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]], these are nano releases without functional changes. We recommend the update for <code>bluespice/wiki</code> in all editions (free, pro and farm). All containers except <code>bluespice/ai</code> were rebuilt with the fixed Brotli library (<code>brotli-libs 1.2.1</code>) and fixed Node.js versions. The image tags <code>5</code>, <code>5.2</code> and <code>5.1</code> point to the fixed images.

In the <code>.env</code> file of <code>bluespice-deploy</code>, set <code>VERSION</code> to <code>5.2</code> or <code>5.1</code>. Then run these commands in the <code>compose</code> directory of <code>bluespice-deploy</code>: <code>./bluespice-deploy pull && ./bluespice-deploy up -d</code>. Use the <code>bluespice-deploy</code> script instead of plain <code>docker compose</code>, because only the script loads all required <code>docker-compose.*.yml</code> files.

To check whether your installation is fixed, run:
* <code>./bluespice-deploy exec wiki-web apk info -v brotli-libs</code> and <code>./bluespice-deploy exec wiki-task apk info -v brotli-libs</code>: must show <code>brotli-libs-1.2.1-r0</code> or higher
* <code>./bluespice-deploy exec chat node -v</code> (BlueSpice 5.2, only if the chat service is used): must show <code>v24.22.1</code> or higher

The container <code>bluespice/ai</code> was '''not''' rebuilt for BlueSpice 5.2.7.2. It will be fixed in BlueSpice 5.2.8. Until then, disable the AI service as described in the table above, if you use it.

=== Mitigation without update: disable ExternalData and ExternalContent (BlueSpice pro and farm) ===
Use the same method as in [[Security:Security Advisories/BSSA-2026-06#Mitigation:_disable_Extension:ExternalData|BSSA-2026-06]]: mount a copy of the settings file in which the extensions are not loaded. In BlueSpice 5.1, the command only finds ExternalData, as ExternalContent is not part of 5.1.
<syntaxhighlight lang="bash">
./bluespice-deploy cp wiki-web:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php ./
sed -i -E "s/^(wfLoadExtension$ 'External(Data|Content)' $;)/#\1/" 040-BlueSpiceProDistribution.php
</syntaxhighlight>
Add the file to <code>docker-compose.override.yml</code>:
<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>
Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version. '''Remove the mount before or together with the update.'''

While the extensions are disabled, pages that use them show the parser functions as plain text or no data. No content is lost.

=== Was my installation compromised? ===
We do not know of any attacks on BlueSpice installations. The vulnerability has been public since 2026-10-21. Public exploit code for a comparable PHP application exists since 2026-10-28.

Installing the update or disabling the extensions stops further exploitation. It does not remove anything an attacker may have left behind. If your wiki uses BlueSpice pro or farm and could connect to servers on the internet, check:
# '''Pages, templates and modules''' with <code><nowiki>{{#get_web_data}}</nowiki></code>, <code><nowiki>{{#get_external_data}}</nowiki></code> or <code><nowiki>{{#embed}}</nowiki></code> that point to servers you do not know, and modules that use <code>mw.ext.externalData</code>.
# '''The access log of the reverse proxy''' for requests to <code>api.php</code> or <code>index.php</code> with these functions. They can also be used without saving a page, e.g. in a preview. See the notes on log analysis in [[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]].
# '''The logs of <code>wiki-web</code> and <code>wiki-task</code>''' for processes that ended with a segmentation fault (e.g. <code>exited on signal 11</code>), and, if available, your firewall logs for connections from the wiki to unknown servers.

If you find signs of an attack, follow the procedure in [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]] (section "Was my installation compromised?") and contact the Hallo Welt! GmbH support.

=== BlueSpice cloud ===

BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH, including the AI service. No action is required from cloud customers.

Security:Security Advisories

2026-10-30T12:54:52Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
| [[Security:Security Advisories/BSSA-2026-09|BSSA-2026-09]]
| 2026-10-29
| Out-of-bounds write in Brotli decompression ("Node2Shell") affecting wiki (pro/farm) and chat containers; forged eMudhra certificates accepted by the AI and chat services
| [https://www.cve.org/CVERecord?id=CVE-2026-111497 CVE-2026-111497], [https://www.cve.org/CVERecord?id=CVE-2026-115557 CVE-2026-115557]
| Out-of-bounds write, Remote Code Execution; Improper certificate validation
| style="" class="col-purple-bg" | Critical
|-
| [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]]
| 2026-10-23
| Remote code execution in PHP ("PHP2Shell") affecting wiki and collabpads containers
| [https://www.cve.org/CVERecord?id=CVE-2026-109618 CVE-2026-109618], [https://www.cve.org/CVERecord?id=CVE-2026-109619 CVE-2026-109619]
| Remote Code Execution, Memory corruption, Use after free
| style="" class="col-purple-bg" | Critical
|-
| [[Security:Security Advisories/BSSA-2026-07|BSSA-2026-07]]
| 2026-10-23
| Privilege escalation in wiki container; missing authorization in BlueSpiceUserManager; library vulnerabilities in formula and search containers
| [https://www.cve.org/CVERecord?id=CVE-2026-25784 CVE-2026-25784], [https://www.cve.org/CVERecord?id=CVE-2026-25716 CVE-2026-25716], [https://www.cve.org/CVERecord?id=CVE-2026-90711 CVE-2026-90711], [https://www.cve.org/CVERecord?id=CVE-2026-75595 CVE-2026-75595], [https://www.cve.org/CVERecord?id=CVE-2026-8763 CVE-2026-8763]
| Privilege escalation, Missing authorization, IP address spoofing, Authentication bypass, Improper certificate validation
| style="" class="col-purple-bg" | Critical
|-
|[[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]]
|2026-09-28
|Security vulnerability in ExternalData extension
|[https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
|Remote code execution
| style="" class="col-purple-bg" |Critical
|-
|[[Security:Security Advisories/BSSA-2026-05|BSSA-2026-05]]
|2026-07-27
|Security vulnerabilities in containers and extensions
|[https://nvd.nist.gov/vuln/detail/CVE-2026-59933 CVE-2026-59933], [https://nvd.nist.gov/vuln/detail/CVE-2025-14813 CVE-2025-14813], [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896], [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
|Uncontrolled ressource consumption, infinite loop
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-04|BSSA-2026-04]]
|2026-06-22
|Security vulnerabilities in Confluence Migration Tool container image
|[https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|Heap buffer overflow vulnerability in Perl Regexes
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories

2026-10-30T11:32:55Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
| [[Security:Security Advisories/BSSA-2026-09|BSSA-2026-09]]
| 2026-10-29
| Out-of-bounds write in Brotli decompression ("Node2Shell") affecting wiki (pro/farm) and chat containers
| [https://www.cve.org/CVERecord?id=CVE-2026-111497 CVE-2026-111497]
| Out-of-bounds write, Remote Code Execution
| style="" class="col-purple-bg" | Critical
|-
| [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]]
| 2026-10-23
| Remote code execution in PHP ("PHP2Shell") affecting wiki and collabpads containers
| [https://www.cve.org/CVERecord?id=CVE-2026-109618 CVE-2026-109618], [https://www.cve.org/CVERecord?id=CVE-2026-109619 CVE-2026-109619]
| Remote Code Execution, Memory corruption, Use after free
| style="" class="col-purple-bg" | Critical
|-
| [[Security:Security Advisories/BSSA-2026-07|BSSA-2026-07]]
| 2026-10-23
| Privilege escalation in wiki container; missing authorization in BlueSpiceUserManager; library vulnerabilities in formula and search containers
| [https://www.cve.org/CVERecord?id=CVE-2026-25784 CVE-2026-25784], [https://www.cve.org/CVERecord?id=CVE-2026-25716 CVE-2026-25716], [https://www.cve.org/CVERecord?id=CVE-2026-90711 CVE-2026-90711], [https://www.cve.org/CVERecord?id=CVE-2026-75595 CVE-2026-75595], [https://www.cve.org/CVERecord?id=CVE-2026-8763 CVE-2026-8763]
| Privilege escalation, Missing authorization, IP address spoofing, Authentication bypass, Improper certificate validation
| style="" class="col-purple-bg" | Critical
|-
|[[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]]
|2026-09-28
|Security vulnerability in ExternalData extension
|[https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
|Remote code execution
| style="" class="col-purple-bg" |Critical
|-
|[[Security:Security Advisories/BSSA-2026-05|BSSA-2026-05]]
|2026-07-27
|Security vulnerabilities in containers and extensions
|[https://nvd.nist.gov/vuln/detail/CVE-2026-59933 CVE-2026-59933], [https://nvd.nist.gov/vuln/detail/CVE-2025-14813 CVE-2025-14813], [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896], [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
|Uncontrolled ressource consumption, infinite loop
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-04|BSSA-2026-04]]
|2026-06-22
|Security vulnerabilities in Confluence Migration Tool container image
|[https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|Heap buffer overflow vulnerability in Perl Regexes
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-09

2026-10-30T11:32:13Z

Rvogel1: Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-10-29 |- |Severity |reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers) |- |Affected | * Container <code>bluespice/wiki</code> in BlueSpice pro and farm 5.1 up to 5.1.11.1 and 5.2 up t..."

Security:Security Advisories

2026-10-26T08:06:55Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
| [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]]
| 2026-10-23
| Remote code execution in PHP ("PHP2Shell") affecting wiki and collabpads containers
| [https://www.cve.org/CVERecord?id=CVE-2026-109618 CVE-2026-109618], [https://www.cve.org/CVERecord?id=CVE-2026-109619 CVE-2026-109619]
| Remote Code Execution, Memory corruption, Use after free
| style="" class="col-purple-bg" | Critical
|-
| [[Security:Security Advisories/BSSA-2026-07|BSSA-2026-07]]
| 2026-10-23
| Privilege escalation in wiki container; missing authorization in BlueSpiceUserManager; library vulnerabilities in formula and search containers
| [https://www.cve.org/CVERecord?id=CVE-2026-25784 CVE-2026-25784], [https://www.cve.org/CVERecord?id=CVE-2026-25716 CVE-2026-25716], [https://www.cve.org/CVERecord?id=CVE-2026-90711 CVE-2026-90711], [https://www.cve.org/CVERecord?id=CVE-2026-75595 CVE-2026-75595], [https://www.cve.org/CVERecord?id=CVE-2026-8763 CVE-2026-8763]
| Privilege escalation, Missing authorization, IP address spoofing, Authentication bypass, Improper certificate validation
| style="" class="col-purple-bg" | Critical
|-
|[[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]]
|2026-09-28
|Security vulnerability in ExternalData extension
|[https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
|Remote code execution
| style="" class="col-purple-bg" |Critical
|-
|[[Security:Security Advisories/BSSA-2026-05|BSSA-2026-05]]
|2026-07-27
|Security vulnerabilities in containers and extensions
|[https://nvd.nist.gov/vuln/detail/CVE-2026-59933 CVE-2026-59933], [https://nvd.nist.gov/vuln/detail/CVE-2025-14813 CVE-2025-14813], [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896], [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
|Uncontrolled ressource consumption, infinite loop
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-04|BSSA-2026-04]]
|2026-06-22
|Security vulnerabilities in Confluence Migration Tool container image
|[https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|Heap buffer overflow vulnerability in Perl Regexes
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-08

2026-10-26T08:06:19Z

Rvogel1: Created page with " {| class="wikitable" |+ ! ! |- |Date |2026-10-23 |- |Severity |reported "critical" (CVSS 4.0: 9.2), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code>), '''low''' (container <code>bluespice/collabpads</code>) |- |Affected | * Container <code>bluespice/wiki</code> in BlueSpice 5.1 up to 5.1.11 and BlueSpice 5.2 up to 5.2.7 (all editions) * Container <code>bluespice/collabpads</code> in BlueSpice 5.1 up to 5.1.11 and BlueSpice 5.2 up to 5.2.7 (not..."

{| class="wikitable"
|+
!
!
|-
|Date
|2026-10-23
|-
|Severity
|reported "critical" (CVSS 4.0: 9.2), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code>), '''low''' (container <code>bluespice/collabpads</code>)
|-
|Affected
|
* Container <code>bluespice/wiki</code> in BlueSpice 5.1 up to 5.1.11 and BlueSpice 5.2 up to 5.2.7 (all editions)
* Container <code>bluespice/collabpads</code> in BlueSpice 5.1 up to 5.1.11 and BlueSpice 5.2 up to 5.2.7 (not exploitable in default configuration)
* BlueSpice installations without containers that use an unpatched PHP version
|-
|Fixed in
|
* BlueSpice 5.1.11.1 and BlueSpice 5.2.7.1 (containers <code>bluespice/wiki</code> and <code>bluespice/collabpads</code>, published on 2026-10-22)
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-109618 CVE-2026-109618]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-109619 CVE-2026-109619]
|}

==Problem==
Two vulnerabilities in the PHP interpreter (publicly known as "PHP2Shell") allow unauthenticated remote code execution on web servers that run PHP. They were disclosed by the PHP project on 2026-10-21. Exploitation in the wild has been reported. BlueSpice is affected because it runs on PHP.

{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-109618
|PHP (containers <code>bluespice/wiki</code> and <code>bluespice/collabpads</code>)
|Remote code execution through memory corruption when PHP runs out of memory while processing a request
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-109619
|PHP (containers <code>bluespice/wiki</code> and <code>bluespice/collabpads</code>)
|Remote code execution through use of freed memory in a later request (use after free)
| style="" class="col-purple-bg" |affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!Component
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/wiki</code>
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |Critical. The wiki container processes all user requests with PHP-FPM. The vulnerabilities can be exploited before any BlueSpice code runs, so no login is needed, and private wikis are affected as well. A successful attacker can run commands inside the wiki container. This gives access to all wiki content and uploaded files, to the secrets of the container (e.g. database credentials) and to the internal services (database, search, cache).
| style="vertical-align:middle;text-align:left;" |No configuration change fully mitigates the vulnerabilities. Take the wiki offline or restrict access to trusted networks (e.g. VPN only) until the update is installed.
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/collabpads</code>
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Low. The collabpads service is a WebSocket server that runs as a single PHP command line process. It does not use the PHP request processing that the vulnerabilities affect. Not exploitable through the known attack paths. The container was updated as a precaution.
| style="vertical-align:middle;text-align:left;" |None required. Update with the next maintenance.
|}

== Solution ==
Update to '''BlueSpice 5.1.11.1''' or '''BlueSpice 5.2.7.1'''. These releases contain only updated containers <code>bluespice/wiki</code> (PHP 8.4.27) and <code>bluespice/collabpads</code> (PHP 8.3.36). The wiki container also disables the PHP setting <code>session.upload_progress.enabled</code>, which BlueSpice does not use.

The other services (e.g. <code>search</code>, <code>pdf</code>, <code>formula</code>) were not re-released and keep their version numbers. The image tags <code>5</code>, <code>5.2</code> and <code>5.1</code> of <code>bluespice/wiki</code> and <code>bluespice/collabpads</code> point to the fixed images. Therefore, in the <code>.env</code> file of <code>bluespice-deploy</code>, set <code>VERSION</code> to <code>5.2</code> or <code>5.1</code>. Do not set it to <code>5.2.7.1</code> or <code>5.1.11.1</code>, as the other services are not available with these tags. Then pull the images and re-create the containers. Run these commands in the <code>compose</code> directory of <code>bluespice-deploy</code>: <code>./bluespice-deploy pull && ./bluespice-deploy up -d</code>. Use the <code>bluespice-deploy</code> script instead of plain <code>docker compose</code>, because only the script loads all required <code>docker-compose.*.yml</code> files.

To check whether your installation is fixed, run:
* <code>./bluespice-deploy exec wiki-web php -v</code>: must show PHP 8.4.27 or higher
* <code>./bluespice-deploy exec collabpads php -v</code> (BlueSpice pro and farm only): must show PHP 8.3.36 or higher

Tarballs of BlueSpice 5.1.11.1 and 5.2.7.1 are available on bluespice.com.

BlueSpice cloud was taken offline as a precaution before the vulnerabilities were announced. We found no evidence of attacks. The cloud instances are already back online with a patched PHP version. No action is required from cloud customers.

BlueSpice 4 is no longer supported. As some people still use it, we published updated images <code>bluespice/wiki:4.5.8.1</code> and <code>bluespice/collabpads:4.5.8.1</code> with a patched PHP version. We strongly recommend updating to BlueSpice 5 though.

=== Was my installation compromised? ===
As far as we know, there were no successful attacks before 2026-10-21.

Installing the update stops further exploitation. It does not remove anything an attacker may have left behind. The risk depends on what you did before the update:

* '''You took the wiki offline''' (or restricted access to trusted networks) when the early warning was published on 2026-10-21 and kept it offline until the update was installed: your installation ''should'' be safe. We still recommend the basic checks below.
* '''Your wiki stayed reachable from untrusted networks''' (especially from the internet) with an unpatched PHP version: the chances of a successful attack are '''high'''. Treat the installation as compromised and follow the procedure below.

==== Basic checks ====
# '''PHP error log:''' check the log of the <code>wiki-web</code> container (<code>./bluespice-deploy logs wiki-web</code>) for messages like <code>Allowed memory size of … bytes exhausted … in Unknown on line 0</code> and for PHP-FPM workers that ended with a segmentation fault (<code>exited on signal 11</code>). Such messages alone do not prove an attack, but they are a reason for a closer look.
# '''Settings files in the data volume:''' check the files <code>pre-init-settings.php</code> and <code>post-init-settings.php</code> in the data volume of the wiki (<code>/data/bluespice</code> in the container) for content that you did not add. Also look for other unexpected <code>.php</code> files in the data volume. These files may be loaded by the wiki and are not replaced by the update.
# '''Users and groups:''' check the members of the groups <code>sysop</code> and <code>bureaucrat</code> (<code>Special:ListUsers</code>) and recently created accounts (<code>Special:Log/newusers</code>).

==== Procedure for installations that stayed reachable ====
An attacker could run any command in the wiki container. This includes reading all secrets of the container, and reading and changing the database, the search index and all files in the data volume. Changes made directly in the database do not show up in the page history.

# '''Preserve the evidence first.''' Before you reset anything, save all log files: the access logs of the reverse proxy, the logs of all containers (<code>./bluespice-deploy logs > logs.txt</code>; container logs are lost when the containers are removed), and the system logs of the server. Also keep a copy of the data volumes and a database dump of the current state for the analysis.
# '''Renew the infrastructure.''' Set up a new server (or virtual machine) with a fresh operating system and install BlueSpice 5.1.11.1 or 5.2.7.1. Do not reuse the old server.
# '''Use new credentials.''' Generate new passwords and secrets for the new installation (database passwords, the secrets in the <code>.env</code> file and the secret files of <code>bluespice-deploy</code>). Also change all credentials that were configured in the old installation, e.g. for LDAP, SAML, mail servers or other connected systems. Ask administrators and users to change their passwords.
# '''Analyze the content before you move it to the new server:'''
#* '''Log files:''' look for unusually large <code>POST</code> requests, requests from unknown addresses and the PHP errors listed in the basic checks, starting from 2026-10-21. If your logs go back further, also check the days before.
#* '''Files:''' scan the data volume (uploaded files, settings files) with an up-to-date virus scanner. Look for <code>.php</code> files and other files that you do not know, and for files that were changed recently.
#* '''Pages:''' check <code>Special:RecentChanges</code> and <code>Special:Log</code> for unexpected changes. Pay special attention to pages in the <code>MediaWiki</code> namespace (e.g. <code>MediaWiki:Common.js</code>, <code>MediaWiki:Common.css</code>), user scripts, templates and pages with many readers. Look for injected scripts, links or forms. As changes made directly in the database leave no trace in the page history, compare important pages with a backup.
#* '''Users and permissions:''' check administrator accounts, new accounts, changes of user groups and, in BlueSpice pro and farm, OAuth applications (<code>Special:OAuthListConsumers</code>).
# '''Restore.''' If possible, restore the data from a backup created before 2026-10-21. Otherwise, only move data that you have checked to the new server.
# '''Check connected systems.''' The server could also be used to attack other systems in your network (lateral movement). Check systems that the wiki server can reach (e.g. directory services, file servers) as well.

If you find signs of an attack, please contact the Hallo Welt! GmbH support.

Security:Security Advisories

2026-10-23T08:48:28Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
| [[Security:Security Advisories/BSSA-2026-07|BSSA-2026-07]]
| 2026-10-23
| Privilege escalation in wiki container; missing authorization in BlueSpiceUserManager; library vulnerabilities in formula and search containers
| [https://www.cve.org/CVERecord?id=CVE-2026-25784 CVE-2026-25784], [https://www.cve.org/CVERecord?id=CVE-2026-25716 CVE-2026-25716], [https://www.cve.org/CVERecord?id=CVE-2026-90711 CVE-2026-90711], [https://www.cve.org/CVERecord?id=CVE-2026-75595 CVE-2026-75595], [https://www.cve.org/CVERecord?id=CVE-2026-8763 CVE-2026-8763]
| Privilege escalation, Missing authorization, IP address spoofing, Authentication bypass, Improper certificate validation
| style="" class="col-purple-bg" | Critical
|-
|[[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]]
|2026-09-28
|Security vulnerability in ExternalData extension
|[https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
|Remote code execution
| style="" class="col-purple-bg" |Critical
|-
|[[Security:Security Advisories/BSSA-2026-05|BSSA-2026-05]]
|2026-07-27
|Security vulnerabilities in containers and extensions
|[https://nvd.nist.gov/vuln/detail/CVE-2026-59933 CVE-2026-59933], [https://nvd.nist.gov/vuln/detail/CVE-2025-14813 CVE-2025-14813], [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896], [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
|Uncontrolled ressource consumption, infinite loop
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-04|BSSA-2026-04]]
|2026-06-22
|Security vulnerabilities in Confluence Migration Tool container image
|[https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|Heap buffer overflow vulnerability in Perl Regexes
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-07

2026-10-23T08:48:10Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-10-23
|-
|Severity
|'''Critical''' (CVSS 4.0: 9.3) for CVE-2026-25784; '''High''' (CVSS 4.0: 7.1) for CVE-2026-25716; Container findings: reported "critical", BlueSpice assessment: '''low'''
|-
|Affected
|
* Container <code>bluespice/wiki</code> in BlueSpice 5.2.3 – 5.2.6, and BlueSpice 5.2.7 images published before 2026-10-19 15:37 UTC (all editions)
* BlueSpice 5.0.0 – 5.1.10, BlueSpice 5.2.0 – 5.2.6 (<code>Extension:BlueSpiceUserManager</code>)
* Containers <code>bluespice/formula</code> and <code>bluespice/search</code> in BlueSpice 5.1 up to 5.1.11 and BlueSpice 5.2 up to 5.2.7 (not exploitable in default configuration)
|-
|Fixed in
|
* BlueSpice 5.2.7 (container <code>bluespice/wiki</code>, images re-published on 2026-10-19)
* BlueSpice 5.1.11, BlueSpice 5.2.7 (<code>Extension:BlueSpiceUserManager</code>)
* Containers: next regular update (<code>bluespice/search</code> and <code>bluespice/formula</code> depend on an upstream release)
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-25784 CVE-2026-25784]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-25716 CVE-2026-25716]
* [https://avd.aquasec.com/nvd/2026/cve-2026-90711/ CVE-2026-90711]
* [https://avd.aquasec.com/nvd/2026/cve-2026-75595/ CVE-2026-75595]
* [https://avd.aquasec.com/nvd/2026/cve-2026-8763/ CVE-2026-8763]
|}

==Problem==
Several vulnerabilities were found in various security reviews and by external researchers.
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-25784
|Container <code>bluespice/wiki</code> (service authentication)
|Privilege escalation through an insecure default configuration (CWE-1188)
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-25716
|<code>Extension:BlueSpiceUserManager</code>
|Missing authorization (CWE-862) when blocking and unblocking users
| style="" class="col-red-bg" |affected
|-
|CVE-2026-90711
|Container <code>bluespice/formula</code> (library <code>proxy-addr</code>)
|IP address spoofing via <code>X-Forwarded-For</code> (CWE-290)
| style="" class="col-orange-bg" |not exploitable
|-
|CVE-2026-75595
|Container <code>bluespice/search</code> (library <code>netty-handler</code>)
|Bypass of TLS client certificate authentication (CWE-754)
| style="" class="col-orange-bg" |not exploitable
|-
|CVE-2026-8763
|Container <code>bluespice/search</code> (library Bouncy Castle)
|Improper certificate validation, name constraints bypass (CWE-295)
| style="" class="col-orange-bg" |not exploitable
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-25784
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |'''Critical'''. The wiki container includes an authentication mechanism for internal BlueSpice services (e.g. chat and AI integrations). This mechanism should only be usable from the internal container network. Because of an error in the default configuration of the container, this restriction was not applied. Any user who can read the wiki could obtain administrator (<code>sysop</code>) privileges through the REST API. On wikis that allow anonymous read access, this includes users who are not logged in. Actions taken this way are recorded as actions of the internal user ''ChatBot service user''. BlueSpice 5.1 and BlueSpice 5.2.1 – 5.2.2 are not affected.
| style="vertical-align:middle;text-align:left;" |Set the environment variable <code>WIKI_SERVICE_TOKEN_AUTH_ALLOWED</code> of the containers <code>wiki-web</code> and <code>wiki-task</code> to the address range of the internal container network (e.g. <code>172.18.0.0/16</code>), or deny access to the path <code>/rest.php/mws/v1/app-token/generate</code> on the reverse proxy.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-25716
| style="vertical-align:middle;text-align:left;" class="col-red-bg" |'''High'''. The REST endpoints that ''Special:UserManager'' uses to enable and disable user accounts do not check the permissions of the requesting user. Any logged-in user can therefore disable (block) any account, including all administrators, or re-enable accounts that administrators have disabled. This can make the wiki unusable for administration. No content is changed and no data is disclosed. All block and unblock actions are recorded in the block log (<code>Special:Log/block</code>).
| style="vertical-align:middle;text-align:left;" |Deny access to the paths <code>/rest.php/bs-usermanager/v1/block/create</code> and <code>/rest.php/bs-usermanager/v1/block/delete</code> on the web server or reverse proxy. While this is in place, users cannot be enabled or disabled from ''Special:UserManager''; administrators can use ''Special:Block'' and ''Special:Unblock'' instead.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-90711
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. The vulnerability only applies if the service is configured to trust proxies by an IPv4-mapped IPv6 subnet. The formula service does not trust any proxy headers, has no user facing route and is only accessed by the wiki. Not exploitable in the default configuration of <code>bluespice-deploy</code> and BlueSpice cloud.
| style="vertical-align:middle;text-align:left;" |None required. Make sure the <code>formula</code> service is not reachable from outside the internal network. This is the default configuration of BlueSpice setups.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-75595
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. The vulnerability only applies to TLS servers that require client certificates for specific host names (SNI). The search service does not use TLS (the OpenSearch security plugin is disabled), has no user facing route and is only accessed by the wiki. Not exploitable in the default configuration of <code>bluespice-deploy</code> and BlueSpice cloud.
| style="vertical-align:middle;text-align:left;" |None required. Make sure the <code>search</code> service is not reachable from outside the internal network. This is the default configuration of BlueSpice setups.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-8763
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. The vulnerability only applies when certificates are validated against certificate authorities that use name constraints. The search service does not use TLS, has no outbound connections and does not perform such certificate validation. Not exploitable in the default configuration of <code>bluespice-deploy</code> and BlueSpice cloud.
| style="vertical-align:middle;text-align:left;" |None required. Make sure the <code>search</code> service is not reachable from outside the internal network. This is the default configuration of BlueSpice setups.
|}

== Solution ==
{{Textbox|boxtype=important|header=|text='''Recommended action:''' Update to BlueSpice 5.2.7 to fix all critical and high rated issues of this BSSA.|icon=yes}}

=== CVE-2026-25784 ===
Update to '''BlueSpice 5.2.7'''. The container images of BlueSpice 5.2.7 were re-published on 2026-10-19 (15:37 UTC) with the fix. If you pulled 5.2.7 images before that time, pull them again and re-create the containers (e.g. <code>docker compose pull && docker compose up -d</code>).

To check whether your installation is fixed, run <code>docker compose exec wiki-web grep -A2 TokenAuthenticatorServiceCIDR /app/conf/LocalSettings.php</code>. The last line of the output must start with <code>?:</code>. If it starts with <code>??</code>, the installation is still affected.

BlueSpice cloud instances are updated by Hallo Welt! GmbH; no action is required from customers.

==== Checking for misuse ====
The issue may have been present since BlueSpice 5.2.3 (April 2026). Installing the update stops any further misuse. Accounts, permissions or OAuth applications that an attacker created before the update keep working until you remove them. We therefore recommend checking your installation after updating.

'''Before you start:''' save the access logs of your reverse proxy for the whole period since the installation of BlueSpice 5.2.3, if available, so that they are not lost to log rotation.

Actions performed through this issue are recorded as actions of the internal user ''ChatBot service user''. BlueSpice services such as chat, MCP or AI integrations also act as this user. To tell them apart, compare with your access logs: legitimate calls come from the internal container network.

# '''Access logs:''' look for requests to <code>/rest.php/mws/v1/app-token/generate</code> from addresses outside of your container network. If your logs cover the whole period and there are no such requests, the issue was not misused.
# '''Logs in the wiki:''' open <code>Special:Log</code> and filter by the performer ''ChatBot service user''. Pay special attention to account creations, changes of user groups, blocks, deletions, imports and page protections.
# '''Contributions:''' check <code>Special:Contributions/ChatBot service user</code> for unexpected edits, especially of pages in the <code>MediaWiki</code> namespace.
# '''Users and groups:''' check the members of the groups <code>sysop</code> and <code>bureaucrat</code> (<code>Special:ListUsers</code>) and all accounts created since BlueSpice 5.2.3 (<code>Special:Log/newusers</code>). Block or delete unknown accounts.
# '''OAuth applications''' (BlueSpice pro and BlueSpice farm only): open <code>Special:OAuthListConsumers</code> and look for applications that were registered by ''ChatBot service user'' or by unknown accounts. Take special care with applications for the owner's own use only ("owner-only"): they allow permanent access without logging in. Disable unknown applications in <code>Special:OAuthManageConsumers</code>.
# '''Configuration:''' check settings that administrators can change in the wiki (e.g. <code>Special:ConfigManager</code>, <code>Special:PermissionManager</code>) for unexpected changes.

If you find signs of misuse, please contact the Hallo Welt! GmbH support.

The membership of ''ChatBot service user'' in the group <code>sysop</code> is intended and does not need to be removed.

=== CVE-2026-25716 ===
Update to '''BlueSpice 5.1.11''' or '''BlueSpice 5.2.7'''. These patch releases require the <code>wikiadmin</code> permission for enabling and disabling users.

BlueSpice 5.0.x will not receive a fix. Please update to one of the versions above.

BlueSpice cloud instances are updated by Hallo Welt! GmbH; no action is required from customers.

After updating, we recommend reviewing the block log (<code>Special:Log/block</code>) for blocks or unblocks performed by users without administrative rights.

=== CVE-2026-90711, CVE-2026-75595, CVE-2026-8763 ===
The containers <code>bluespice/formula</code> and <code>bluespice/search</code> will receive updated libraries with the next regular update of BlueSpice. For <code>bluespice/search</code>, this depends on the availability of an OpenSearch release with the fixed libraries. No immediate action is required, as the vulnerabilities are not exploitable in the default configuration.

== Credits ==
We thank kta1kri for responsibly reporting the issue documented in CVE-2026-25716.

Security:Security Advisories

2026-10-23T08:47:35Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
| [[Security:Security Advisories/BSSA-2026-07|BSSA-2026-07]]
| 2026-10-19
| Privilege escalation in wiki container; missing authorization in BlueSpiceUserManager; library vulnerabilities in formula and search containers
| [https://www.cve.org/CVERecord?id=CVE-2026-25784 CVE-2026-25784], [https://www.cve.org/CVERecord?id=CVE-2026-25716 CVE-2026-25716], [https://www.cve.org/CVERecord?id=CVE-2026-90711 CVE-2026-90711], [https://www.cve.org/CVERecord?id=CVE-2026-75595 CVE-2026-75595], [https://www.cve.org/CVERecord?id=CVE-2026-8763 CVE-2026-8763]
| Privilege escalation, Missing authorization, IP address spoofing, Authentication bypass, Improper certificate validation
| style="" class="col-purple-bg" | Critical
|-
|[[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]]
|2026-09-28
|Security vulnerability in ExternalData extension
|[https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
|Remote code execution
| style="" class="col-purple-bg" |Critical
|-
|[[Security:Security Advisories/BSSA-2026-05|BSSA-2026-05]]
|2026-07-27
|Security vulnerabilities in containers and extensions
|[https://nvd.nist.gov/vuln/detail/CVE-2026-59933 CVE-2026-59933], [https://nvd.nist.gov/vuln/detail/CVE-2025-14813 CVE-2025-14813], [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896], [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
|Uncontrolled ressource consumption, infinite loop
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-04|BSSA-2026-04]]
|2026-06-22
|Security vulnerabilities in Confluence Migration Tool container image
|[https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|Heap buffer overflow vulnerability in Perl Regexes
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-07

2026-10-23T08:36:43Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-10-19
|-
|Severity
|'''Critical''' (CVSS 4.0: 9.3) for CVE-2026-25784; '''High''' (CVSS 4.0: 7.1) for CVE-2026-25716; Container findings: reported "critical", BlueSpice assessment: '''low'''
|-
|Affected
|
* Container <code>bluespice/wiki</code> in BlueSpice 5.2.3 – 5.2.6, and BlueSpice 5.2.7 images published before 2026-10-19 15:37 UTC (all editions)
* BlueSpice 5.0.0 – 5.1.10, BlueSpice 5.2.0 – 5.2.6 (<code>Extension:BlueSpiceUserManager</code>)
* Containers <code>bluespice/formula</code> and <code>bluespice/search</code> in BlueSpice 5.1 up to 5.1.11 and BlueSpice 5.2 up to 5.2.7 (not exploitable in default configuration)
|-
|Fixed in
|
* BlueSpice 5.2.7 (container <code>bluespice/wiki</code>, images re-published on 2026-10-19)
* BlueSpice 5.1.11, BlueSpice 5.2.7 (<code>Extension:BlueSpiceUserManager</code>)
* Containers: next regular update (<code>bluespice/search</code> and <code>bluespice/formula</code> depend on an upstream release)
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-25784 CVE-2026-25784]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-25716 CVE-2026-25716]
* [https://avd.aquasec.com/nvd/2026/cve-2026-90711/ CVE-2026-90711]
* [https://avd.aquasec.com/nvd/2026/cve-2026-75595/ CVE-2026-75595]
* [https://avd.aquasec.com/nvd/2026/cve-2026-8763/ CVE-2026-8763]
|}

==Problem==
Several vulnerabilities were found in various security reviews and by external researchers.
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-25784
|Container <code>bluespice/wiki</code> (service authentication)
|Privilege escalation through an insecure default configuration (CWE-1188)
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-25716
|<code>Extension:BlueSpiceUserManager</code>
|Missing authorization (CWE-862) when blocking and unblocking users
| style="" class="col-red-bg" |affected
|-
|CVE-2026-90711
|Container <code>bluespice/formula</code> (library <code>proxy-addr</code>)
|IP address spoofing via <code>X-Forwarded-For</code> (CWE-290)
| style="" class="col-orange-bg" |not exploitable
|-
|CVE-2026-75595
|Container <code>bluespice/search</code> (library <code>netty-handler</code>)
|Bypass of TLS client certificate authentication (CWE-754)
| style="" class="col-orange-bg" |not exploitable
|-
|CVE-2026-8763
|Container <code>bluespice/search</code> (library Bouncy Castle)
|Improper certificate validation, name constraints bypass (CWE-295)
| style="" class="col-orange-bg" |not exploitable
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-25784
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |'''Critical'''. The wiki container includes an authentication mechanism for internal BlueSpice services (e.g. chat and AI integrations). This mechanism should only be usable from the internal container network. Because of an error in the default configuration of the container, this restriction was not applied. Any user who can read the wiki could obtain administrator (<code>sysop</code>) privileges through the REST API. On wikis that allow anonymous read access, this includes users who are not logged in. Actions taken this way are recorded as actions of the internal user ''ChatBot service user''. BlueSpice 5.1 and BlueSpice 5.2.1 – 5.2.2 are not affected.
| style="vertical-align:middle;text-align:left;" |Set the environment variable <code>WIKI_SERVICE_TOKEN_AUTH_ALLOWED</code> of the containers <code>wiki-web</code> and <code>wiki-task</code> to the address range of the internal container network (e.g. <code>172.18.0.0/16</code>), or deny access to the path <code>/rest.php/mws/v1/app-token/generate</code> on the reverse proxy.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-25716
| style="vertical-align:middle;text-align:left;" class="col-red-bg" |'''High'''. The REST endpoints that ''Special:UserManager'' uses to enable and disable user accounts do not check the permissions of the requesting user. Any logged-in user can therefore disable (block) any account, including all administrators, or re-enable accounts that administrators have disabled. This can make the wiki unusable for administration. No content is changed and no data is disclosed. All block and unblock actions are recorded in the block log (<code>Special:Log/block</code>).
| style="vertical-align:middle;text-align:left;" |Deny access to the paths <code>/rest.php/bs-usermanager/v1/block/create</code> and <code>/rest.php/bs-usermanager/v1/block/delete</code> on the web server or reverse proxy. While this is in place, users cannot be enabled or disabled from ''Special:UserManager''; administrators can use ''Special:Block'' and ''Special:Unblock'' instead.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-90711
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. The vulnerability only applies if the service is configured to trust proxies by an IPv4-mapped IPv6 subnet. The formula service does not trust any proxy headers, has no user facing route and is only accessed by the wiki. Not exploitable in the default configuration of <code>bluespice-deploy</code> and BlueSpice cloud.
| style="vertical-align:middle;text-align:left;" |None required. Make sure the <code>formula</code> service is not reachable from outside the internal network. This is the default configuration of BlueSpice setups.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-75595
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. The vulnerability only applies to TLS servers that require client certificates for specific host names (SNI). The search service does not use TLS (the OpenSearch security plugin is disabled), has no user facing route and is only accessed by the wiki. Not exploitable in the default configuration of <code>bluespice-deploy</code> and BlueSpice cloud.
| style="vertical-align:middle;text-align:left;" |None required. Make sure the <code>search</code> service is not reachable from outside the internal network. This is the default configuration of BlueSpice setups.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-8763
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |'''Low'''. The vulnerability only applies when certificates are validated against certificate authorities that use name constraints. The search service does not use TLS, has no outbound connections and does not perform such certificate validation. Not exploitable in the default configuration of <code>bluespice-deploy</code> and BlueSpice cloud.
| style="vertical-align:middle;text-align:left;" |None required. Make sure the <code>search</code> service is not reachable from outside the internal network. This is the default configuration of BlueSpice setups.
|}

== Solution ==
{{Textbox|boxtype=important|header=|text='''Recommended action:''' Update to BlueSpice 5.2.7 to fix all critical and high rated issues of this BSSA.|icon=yes}}

=== CVE-2026-25784 ===
Update to '''BlueSpice 5.2.7'''. The container images of BlueSpice 5.2.7 were re-published on 2026-10-19 (15:37 UTC) with the fix. If you pulled 5.2.7 images before that time, pull them again and re-create the containers (e.g. <code>docker compose pull && docker compose up -d</code>).

To check whether your installation is fixed, run <code>docker compose exec wiki-web grep -A2 TokenAuthenticatorServiceCIDR /app/conf/LocalSettings.php</code>. The last line of the output must start with <code>?:</code>. If it starts with <code>??</code>, the installation is still affected.

BlueSpice cloud instances are updated by Hallo Welt! GmbH; no action is required from customers.

==== Checking for misuse ====
The issue may have been present since BlueSpice 5.2.3 (April 2026). Installing the update stops any further misuse. Accounts, permissions or OAuth applications that an attacker created before the update keep working until you remove them. We therefore recommend checking your installation after updating.

'''Before you start:''' save the access logs of your reverse proxy for the whole period since the installation of BlueSpice 5.2.3, if available, so that they are not lost to log rotation.

Actions performed through this issue are recorded as actions of the internal user ''ChatBot service user''. BlueSpice services such as chat, MCP or AI integrations also act as this user. To tell them apart, compare with your access logs: legitimate calls come from the internal container network.

# '''Access logs:''' look for requests to <code>/rest.php/mws/v1/app-token/generate</code> from addresses outside of your container network. If your logs cover the whole period and there are no such requests, the issue was not misused.
# '''Logs in the wiki:''' open <code>Special:Log</code> and filter by the performer ''ChatBot service user''. Pay special attention to account creations, changes of user groups, blocks, deletions, imports and page protections.
# '''Contributions:''' check <code>Special:Contributions/ChatBot service user</code> for unexpected edits, especially of pages in the <code>MediaWiki</code> namespace.
# '''Users and groups:''' check the members of the groups <code>sysop</code> and <code>bureaucrat</code> (<code>Special:ListUsers</code>) and all accounts created since BlueSpice 5.2.3 (<code>Special:Log/newusers</code>). Block or delete unknown accounts.
# '''OAuth applications''' (BlueSpice pro and BlueSpice farm only): open <code>Special:OAuthListConsumers</code> and look for applications that were registered by ''ChatBot service user'' or by unknown accounts. Take special care with applications for the owner's own use only ("owner-only"): they allow permanent access without logging in. Disable unknown applications in <code>Special:OAuthManageConsumers</code>.
# '''Configuration:''' check settings that administrators can change in the wiki (e.g. <code>Special:ConfigManager</code>, <code>Special:PermissionManager</code>) for unexpected changes.

If you find signs of misuse, please contact the Hallo Welt! GmbH support.

The membership of ''ChatBot service user'' in the group <code>sysop</code> is intended and does not need to be removed.

=== CVE-2026-25716 ===
Update to '''BlueSpice 5.1.11''' or '''BlueSpice 5.2.7'''. These patch releases require the <code>wikiadmin</code> permission for enabling and disabling users.

BlueSpice 5.0.x will not receive a fix. Please update to one of the versions above.

BlueSpice cloud instances are updated by Hallo Welt! GmbH; no action is required from customers.

After updating, we recommend reviewing the block log (<code>Special:Log/block</code>) for blocks or unblocks performed by users without administrative rights.

=== CVE-2026-90711, CVE-2026-75595, CVE-2026-8763 ===
The containers <code>bluespice/formula</code> and <code>bluespice/search</code> will receive updated libraries with the next regular update of BlueSpice. For <code>bluespice/search</code>, this depends on the availability of an OpenSearch release with the fixed libraries. No immediate action is required, as the vulnerabilities are not exploitable in the default configuration.

== Credits ==
We thank kta1kri for responsibly reporting the issue documented in CVE-2026-25716.

Security:Security Advisories/BSSA-2026-07

2026-10-23T06:12:58Z

Rvogel1: Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-10-19 |- |Severity |Critical (CVSS 4.0: 9.3) for CVE-2026-25784; High (CVSS 4.0: 7.1) for CVE-2026-25716; Container findings: reported "critical", BlueSpice assessment: '''low''' |- |Affected | * Container <code>bluespice/wiki</code> in BlueSpice 5.2.3 – 5.2.6, and BlueSpice 5.2.7 images published before 2026-10-19 15:37 UTC (all editions) * BlueSpice 5.0.0 – 5.1.10, BlueSpice 5.2.0 – 5.2.6 (<code>Extension:BlueSpiceUserMa..."

{| class="wikitable"
|+
!
!
|-
|Date
|2026-10-19
|-
|Severity
|Critical (CVSS 4.0: 9.3) for CVE-2026-25784; High (CVSS 4.0: 7.1) for CVE-2026-25716; Container findings: reported "critical", BlueSpice assessment: '''low'''
|-
|Affected
|
* Container <code>bluespice/wiki</code> in BlueSpice 5.2.3 – 5.2.6, and BlueSpice 5.2.7 images published before 2026-10-19 15:37 UTC (all editions)
* BlueSpice 5.0.0 – 5.1.10, BlueSpice 5.2.0 – 5.2.6 (<code>Extension:BlueSpiceUserManager</code>)
* Containers <code>bluespice/formula</code> and <code>bluespice/search</code> in BlueSpice 5.1 up to 5.1.10 and BlueSpice 5.2 up to 5.2.6 (not exploitable in default configuration)
|-
|Fixed in
|
* BlueSpice 5.2.7 (container <code>bluespice/wiki</code>, images re-published on 2026-10-19)
* BlueSpice 5.1.11, BlueSpice 5.2.7 (<code>Extension:BlueSpiceUserManager</code>)
* Containers: next regular update (<code>bluespice/search</code> depends on an upstream OpenSearch release)
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-25784 CVE-2026-25784]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-25716 CVE-2026-25716]
* [https://avd.aquasec.com/nvd/2026/cve-2026-90711/ CVE-2026-90711]
* [https://avd.aquasec.com/nvd/2026/cve-2026-75595/ CVE-2026-75595]
* [https://avd.aquasec.com/nvd/2026/cve-2026-8763/ CVE-2026-8763]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-25784
|Container <code>bluespice/wiki</code> (service authentication)
|Privilege escalation through an insecure default configuration (CWE-1188)
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-25716
|<code>Extension:BlueSpiceUserManager</code>
|Missing authorization (CWE-862) when blocking and unblocking users
| style="" class="col-red-bg" |affected
|-
|CVE-2026-90711
|Container <code>bluespice/formula</code> (library <code>proxy-addr</code>)
|IP address spoofing via <code>X-Forwarded-For</code> (CWE-290)
| style="" class="col-orange-bg" |not exploitable
|-
|CVE-2026-75595
|Container <code>bluespice/search</code> (library <code>netty-handler</code>)
|Bypass of TLS client certificate authentication (CWE-754)
| style="" class="col-orange-bg" |not exploitable
|-
|CVE-2026-8763
|Container <code>bluespice/search</code> (library Bouncy Castle)
|Improper certificate validation, name constraints bypass (CWE-295)
| style="" class="col-orange-bg" |not exploitable
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-25784
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |Affected. The wiki container includes an authentication mechanism for internal BlueSpice services (e.g. chat and AI integrations). This mechanism should only be usable from the internal container network. Because of an error in the default configuration of the container, this restriction was not applied. Any user who can read the wiki could obtain administrator (<code>sysop</code>) privileges through the REST API. On wikis that allow anonymous read access, this includes users who are not logged in. Actions taken this way are recorded as actions of the internal user ''ChatBot service user''. BlueSpice 5.1 and BlueSpice 5.2.1 – 5.2.2 are not affected.
| style="vertical-align:middle;text-align:left;" |Set the environment variable <code>WIKI_SERVICE_TOKEN_AUTH_ALLOWED</code> of the containers <code>wiki-web</code> and <code>wiki-task</code> to the address range of the internal container network (e.g. <code>172.18.0.0/16</code>), or deny access to the path <code>/rest.php/mws/v1/app-token/generate</code> on the reverse proxy.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-25716
| style="vertical-align:middle;text-align:left;" class="col-red-bg" |Affected. The REST endpoints that ''Special:UserManager'' uses to enable and disable user accounts do not check the permissions of the requesting user. Any logged-in user can therefore disable (block) any account, including all administrators, or re-enable accounts that administrators have disabled. This can make the wiki unusable for administration. No content is changed and no data is disclosed. All block and unblock actions are recorded in the block log (<code>Special:Log/block</code>).
| style="vertical-align:middle;text-align:left;" |Deny access to the paths <code>/rest.php/bs-usermanager/v1/block/create</code> and <code>/rest.php/bs-usermanager/v1/block/delete</code> on the web server or reverse proxy. While this is in place, users cannot be enabled or disabled from ''Special:UserManager''; administrators can use ''Special:Block'' and ''Special:Unblock'' instead.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-90711
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Low. The vulnerability only applies if the service is configured to trust proxies by an IPv4-mapped IPv6 subnet. The formula service does not trust any proxy headers, has no user facing route and is only accessed by the wiki. Not exploitable in the default configuration of <code>bluespice-deploy</code> and BlueSpice cloud.
| style="vertical-align:middle;text-align:left;" |None required. Make sure the <code>formula</code> service is not reachable from outside the internal network. This is the default configuration of BlueSpice setups.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-75595
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Low. The vulnerability only applies to TLS servers that require client certificates for specific host names (SNI). The search service does not use TLS (the OpenSearch security plugin is disabled), has no user facing route and is only accessed by the wiki. Not exploitable in the default configuration of <code>bluespice-deploy</code> and BlueSpice cloud.
| style="vertical-align:middle;text-align:left;" |None required. Make sure the <code>search</code> service is not reachable from outside the internal network. This is the default configuration of BlueSpice setups.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-8763
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Low. The vulnerability only applies when certificates are validated against certificate authorities that use name constraints. The search service does not use TLS, has no outbound connections and does not perform such certificate validation. Not exploitable in the default configuration of <code>bluespice-deploy</code> and BlueSpice cloud.
| style="vertical-align:middle;text-align:left;" |None required. Make sure the <code>search</code> service is not reachable from outside the internal network. This is the default configuration of BlueSpice setups.
|}

== Solution ==
=== CVE-2026-25784 ===
Update to '''BlueSpice 5.2.7'''. The container images of BlueSpice 5.2.7 were re-published on 2026-10-19 (15:37 UTC) with the fix. If you pulled 5.2.7 images before that time, pull them again and re-create the containers (e.g. <code>docker compose pull && docker compose up -d</code>).

To check whether your installation is fixed, run <code>docker compose exec wiki-web grep -A2 TokenAuthenticatorServiceCIDR /app/conf/LocalSettings.php</code>. The last line of the output must start with <code>?:</code>. If it starts with <code>??</code>, the installation is still affected.

BlueSpice cloud instances are updated by Hallo Welt! GmbH; no action is required from customers.

==== Checking for misuse ====
The issue may have been present since BlueSpice 5.2.3 (April 2026). Installing the update stops any further misuse. Accounts, permissions or OAuth applications that an attacker created before the update keep working until you remove them. We therefore recommend checking your installation after updating.

'''Before you start:''' save the access logs of your reverse proxy for the whole period since the installation of BlueSpice 5.2.3, if available, so that they are not lost to log rotation.

Actions performed through this issue are recorded as actions of the internal user ''ChatBot service user''. BlueSpice services such as chat, MCP or AI integrations also act as this user. To tell them apart, compare with your access logs: legitimate calls come from the internal container network.

# '''Access logs:''' look for requests to <code>/rest.php/mws/v1/app-token/generate</code> from addresses outside of your container network. If your logs cover the whole period and there are no such requests, the issue was not misused.
# '''Logs in the wiki:''' open <code>Special:Log</code> and filter by the performer ''ChatBot service user''. Pay special attention to account creations, changes of user groups, blocks, deletions, imports and page protections.
# '''Contributions:''' check <code>Special:Contributions/ChatBot service user</code> for unexpected edits, especially of pages in the <code>MediaWiki</code> namespace.
# '''Users and groups:''' check the members of the groups <code>sysop</code> and <code>bureaucrat</code> (<code>Special:ListUsers</code>) and all accounts created since BlueSpice 5.2.3 (<code>Special:Log/newusers</code>). Block or delete unknown accounts.
# '''OAuth applications''' (BlueSpice pro and BlueSpice farm only): open <code>Special:OAuthListConsumers</code> and look for applications that were registered by ''ChatBot service user'' or by unknown accounts. Take special care with applications for the owner's own use only ("owner-only"): they allow permanent access without logging in. Disable unknown applications in <code>Special:OAuthManageConsumers</code>.
# '''Configuration:''' check settings that administrators can change in the wiki (e.g. <code>Special:ConfigManager</code>, <code>Special:PermissionManager</code>) for unexpected changes.

If you find signs of misuse, please contact the Hallo Welt! GmbH support.

The membership of ''ChatBot service user'' in the group <code>sysop</code> is intended and does not need to be removed.

=== CVE-2026-25716 ===
Update to '''BlueSpice 5.1.11''' or '''BlueSpice 5.2.7'''. These patch releases require the <code>wikiadmin</code> permission for enabling and disabling users.

BlueSpice 5.0.x will not receive a fix. Please update to one of the versions above.

BlueSpice cloud instances are updated by Hallo Welt! GmbH; no action is required from customers.

After updating, we recommend reviewing the block log (<code>Special:Log/block</code>) for blocks or unblocks performed by users without administrative rights.

=== CVE-2026-90711, CVE-2026-75595, CVE-2026-8763 ===
The containers <code>bluespice/formula</code> and <code>bluespice/search</code> will receive updated libraries with the next regular update of BlueSpice. For <code>bluespice/search</code>, this depends on the availability of an OpenSearch release with the fixed libraries. No immediate action is required, as the vulnerabilities are not exploitable in the default configuration.

== Credits ==
We thank kta1kri for responsibly reporting the issue documented in CVE-2026-25716.

Setup:Installation Guide/Docker

2026-10-19T12:10:00Z

Rvogel1: Bump version

== Overview ==
Starting with version 4.5, BlueSpice MediaWiki can be installed with a stack of Docker container images.

Everything is built in a modular way to allow different types of setups.

The most common cases are:
# "All-in-one" (with and without Let's Encrypt)
# Custom database and search service
# Custom load balancer / proxy

== Architecture ==
<drawio filename="Setup:Installation_Guide_Docker-Achitecture" alt="Diagram of BlueSpice Docker Stack Architecture" />

'''Notes'''
* Internal HTTP connections may use non-standard ports. Those are noted next to the respective services.
** HTTP (in-secure) is only used for internal communication within the virtual network the stack is operated in. All connections to the client use TLS.
* Proprietary ports (esp. for database connections) are noted next to the respective services.
* There may be additional services and ports in use, based on the setup. Some examples:
** When using LDAP based authentication an LDAPS connection (port <code>636</code>) is used from the <code>bluespice/wiki</code> containers to the LDAP-Server
** When using Kerberos authentication, a connection (port <code>88</code>) is used from the <code>bluespice/kerberos-proxy</code> containers to the Kerberos-Server
** When using DeepL or OpenAI services, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> containers to to the respective service
** When using OpenIDConnect authentication, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> "task" container to to the authentication provider
** When using "Let's Encrypt" Certbot, a HTTPS connection (port <code>443</code>) is used from the <code>acme-companion</code> container to the "Let's Encrypt" service

== Step 1: Get the stack ==
Load project <code>bluespice-deploy</code> from https://github.com/hallowelt/bluespice-deploy/releases/latest and enter the sub-directory <code>compose</code> for Docker Compose files.

For example, run:
<syntaxhighlight lang="sh">
wget https://github.com/hallowelt/bluespice-deploy/archive/refs/tags/5.2.7.zip \
&& unzip 5.2.7.zip \
&& cd bluespice-deploy-5.2.7/compose
</syntaxhighlight>
{{Textbox|boxtype=note|header=Use one consistent version number|text=The tag number 5.2.7 in this command (could be 5.1.9, 5.2.4 etc. as well) should also be used as the <code>VERSION=</code> number in Step 2.|icon=yes}}

The directory contains the following files:
{| class="wikitable"
|+
! style="width:375px;" |Filename
! style="" |Type
! style="" |Comment
|-
| style="width:375px;" |<code>bluespice-deploy</code>
| style="" |shell script
| style="" |Start-up script, wrapping command <code>docker compose</code> and service <code>yml</code> files.<br>Additional service <code>yml</code> files can be loaded by adding <code>-f <filename> </code>.
|-
| style="width:375px;" |<code>docker-compose.main.yml</code>
| style="" |yml
| style="" |Main containers of the wiki (<code>wiki-web</code> and <code>wiki-task</code>).
|-
| style="width:375px;" |<code>docker-compose.persistent-data-services.yml</code>
| style="" |yml
| style="" |Containers of database and search services, storing persistent data onto the file system.<br />Optionally with external MySQL/MariaDB and OpenSearch one can skip loading this <code>.yml</code> in <code>bluespice-deploy</code>. Please then wire your services properly in the <code>.env</code> file.
|-
| style="width:375px;" |<code>docker-compose.stateless-services.yml</code>
| style="" |yml
| style="" |Containers for caching, PDF rendering, formula-rendering and diagram editing.
|-
| style="width:375px;" |<code>docker-compose.helper-service.yml</code>
| style="" |yml
| style="" |Helper containers for file system preparation and automated BlueSpice upgrade.<br>These containers exit automatically after finishing tasks.
|-
| style="width:375px;" |<code>docker-compose.proxy.yml</code>
| style="" |yml
| style="" |Container of proxy service. Can be replaced by existing proxy/load-balancer infrastructure.
|-
| style="width:375px;" |<code>docker-compose.proxy-letsencrypt.yml</code>
| style="" |yml
| style="" |Additional service for auto-renewal of "Let's Encrypt" certificates.<br>Only required when using the Let's Encrypt service and having no other TLS termination.
|-
| style="width:375px;" |<code>docker-compose.kerberos-proxy.yml</code>
| style="" |yml
| style="" |Additional proxy for Kerberos based authentication.
|-
| style="width:375px;" |<code>docker-compose.collabpads-service.yml</code>
|yml
|Containers of back-end services for [[Manual:Extension/CollabPads|CollabPads]] (included in Pro and Farm editions).
|-
| style="width:375px;" |<code>.env.sample</code>
| style="" |text
| style="" |Sample for creating <code>.env</code> that defines key environment variables.
|-
| style="width:375px;" |<code>bluespice.service.demo</code>
| style="" |service script
| style="" |Demo-file for control the BlueSpice stack as a <code>systemctl</code> service.<br>One can create e.g a <code>/etc/systemd/system/bluespice.service</code>.
|}

== Step 2: Set up environment variables ==
Create your <code>.env</code> based on the sample file <code>.env.sample</code>.

Example:
<pre>
# set or use your data directory
DATADIR=/data/bluespice
VERSION=5.2.5
EDITION=free
BACKUP_HOUR=04

WIKI_NAME=BlueSpice
WIKI_LANG=en
WIKI_PASSWORDSENDER=no-reply@wiki.company.local
WIKI_EMERGENCYCONTACT=no-reply@wiki.company.local
WIKI_HOST=wiki.company.local
WIKI_PORT=443
WIKI_PROTOCOL=https
WIKI_BASE_PATH=

DB_USER=set_or_use_your_db_user_name
DB_PASS=SET_OR_USE_YOUR_DB_PASS_WORD
DB_ROOT_USER=root
DB_ROOT_PASS=$DB_PASS
DB_HOST=database
DB_NAME=bluespice
DB_PREFIX=

SMTP_HOST=mail.company.local
SMTP_PORT=25
SMTP_USER=...
SMTP_PASS=...
SMTP_ID_HOST=...

LETSENCRYPT=false
</pre>
{{Textbox|boxtype=note|header=Different editions|text=This config works for all editions, but the main image of Pro or Farm edition needs to be obtained differently, see [[{{FULLPAGENAME}}/Pro and Farm edition|Pro and Farm edition]]|icon=yes}}

== Step 3: Start the stack ==
Use <code>bluespice-deploy up -d</code> to start the stack. Once all containers are shown as "ready" you can navigate to <code>$WIKI_PROTOCOL://$WIKI_HOST:$WIKI_PORT</code> (e.g. <code><nowiki>https://wiki.company.local</nowiki></code>) in your preferred web browser and start using the application.

When starting the stack the first time, the <code>wiki-task</code> container will automatically perform the installation. It may take a couple of minutes for the process to set up the database and complete. Once it is finished, the password for the default <code>Admin</code> user can be found in <code>$DATADIR/wiki/initialAdminPassword</code>.

== Additional options ==

=== Add Customizations to containers ===
Since tag 5.1.4 and tag 5.2.0 of project <code>bluespice-deploy</code>, we allow to edit and maintain a separate <code>docker-compose.override.yml</code> which will be ignored by git.

This way you can add your own Container-Configurations and be able to maintain your git status up to date. Just place the file next to the other <code>docker-compose.*.yml</code> s and run <code>./bluespice-deploy up -d</code>.

Example:<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- /backup/:/data/backup
wiki-task:
volumes:
- /backup/:/data/backup
</syntaxhighlight>

=== Configs for <code>LocalSettings.php</code> ===
Instead of exposing the <code>LocalSettings.php</code> for [[mediawikiwiki:Manual:LocalSettings.php|adding additional configurations]], the stack offers two entry points. After the initial installation, you can add your configs to two files in <code>${DATADIR}/wiki/bluespice/</code>:

* <code>pre-init-settings.php</code> - Set configs before the initialization of BlueSpice's debug logging, libraries, skins, extensions and default settings. Configs set here can be picked up by the init process.
* <code>post-init-settings.php</code> - Set configs after the initialization, manipulating configs that have been set by the init process.
For example, if you add the following lines to <code>pre-init-settings.php</code>, you can then read outputted debug logs (if any) in <code>${DATADIR}/wiki/bluespice/logs/debug.log</code>:<syntaxhighlight lang="php">
$GLOBALS['bsgDebugLogGroups']['exception'] = "/data/bluespice/logs/debug.log";
$wgShowExceptionDetails = true;
</syntaxhighlight>

=== Maintenance scripts ===
To run [[Setup:Installation Guide/Advanced/Maintenance scripts|maintenance scripts]] from MediaWiki or from other extensions, please use the <code>wiki-task</code> container, which handles all back-end jobs and processes. You can connect into the container in two different ways:

* run <code>./bluespice-deploy exec -it wiki-task bash</code> in the <code>compose</code> directory for Docker Compose files
* or alternatively, run <code>docker exec -it bluespice-wiki-task bash</code> wherever you are on the host machine

Inside the container you can enter the wiki's code base with <code>cd /app/bluespice/w</code> , where one can run scripts like <code>php maintenance/run.php update --quick</code>, <code>php extensions/BlueSpiceExtendedSearch/maintenance/updateWikiPageIndex.php</code> and so on.

=== SSL certificates ===
To use a Let's Encrypt certificate for your domain name, set <code>LETSENCRYPT=true</code> in your <code>.env</code> file.

To use a self-signend certificate for your domain name, put its <code>.crt</code> and <code>.key</code> files in <code>${DATADIR}/proxy/certs</code>. For example, with <code>wiki.company.local</code> you should prepare <code>wiki.company.local.crt</code> and <code>wiki.company.local.key</code> files.

=== Kerberos proxy ===
For implicit authentication using Kerberos, an additional proxy must be used: <code>bluespice/kerberos-proxy</code> . The file <code>docker-compose.kerberos-proxy.yml</code> contains a common configuration. It can be used '''instead of''' the regular <code>docker-compose.proxy.yml</code> file inside <code>bluespice-deploy</code> .

Make sure to have the files

* <code>${DATADIR}/kerberos/krb5.conf</code>
* <code>${DATADIR}/kerberos/kerberos.keytab</code>

set up properly.

The file <code>${DATADIR}/wiki/bluespice/pre-init-settings.php</code> can then be used to set up [[mediawikiwiki:LDAP_hub|"Extension:Auth_remoteuser" and the LDAP stack extensions]].

=== SAML authentication ===
During the initial installation a certificate for message signing will automatically be created. It can be found in <code>${DATADIR}/wiki/simplesamlphp/certs/</code>.

In order to configure a remote IdP, one must copy the IdP metadata XML to a file called <code>${DATADIR}/wiki/simplesamlphp/saml_idp_metadata.xml</code>. The SP metadata can then be obtained via <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/saml/sp/metadata.php/default-sp</nowiki></code>. It must be configured in the remote IdP.

{{Textbox
|boxtype=tip
|header=Test authentication
|text= You can test authentication directly within the SimpleSAMLphp application. To do so, navigate to <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/admin</nowiki></code> and log in with <code>admin</code> and the <code>INTERNAL_SIMPLESAMLPHP_ADMIN_PASS</code> found in <code>${DATADIR}/wiki/.wikienv</code>
|icon=yes
}}

Next, the extensions "PluggableAuth" and "SimpleSAMLphp" must be enabled on the wiki. To do so, add

<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'SimpleSAMLphp'
] );
</syntaxhighlight>[[File:Setup:SAML ConfigManager EN 01.png|thumb|300x300px]]to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

=== OpenID Connect authentication ===

The extensions "PluggableAuth" and "OpenIDConnect" must be enabled on the wiki. To do so, add<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'OpenIDConnect'
] );
</syntaxhighlight>to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

[[de:Setup:Installationsanleitung/Docker]]

Security:Security Advisories/BSSA-2026-06

2026-09-29T06:03:44Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-09-28
|-
|Severity
|reported "critical", BlueSpice assessment: '''critical'''
|-
|Affected
|<code>bluespice/wiki</code> Docker image (all versions)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
|}

== Problem ==
{| class="wikitable" style="width: 100%;"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-100382
|[[mediawikiwiki:Extension:External_Data|Extension:ExternalData]]
|Remote Code Execution
| style="" class="col-purple-bg" |affected
|}

== Impact assessment ==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-100382
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |Attackers with "read" permission can execute arbitrary commands in context of the <code>wiki-web</code> container
| style="vertical-align:middle;text-align:left;" |Deactivate [[mediawikiwiki:Extension:External_Data|Extension:ExternalData]]
|}

== Solution ==

=== Timeline and exposure window ===

* 2026-09-25: CVE published. A fix exists upstream in ExternalData 3.7.
* From 2026-09-26: mass automated scanning and exploitation, observed by us and other MediaWiki operators.
* Assume the exposure window runs '''from 2026-09-25 until the moment you applied the mitigation below'''.
* Since 2026-09-28, Extension:ExternalData has been disabled on all wikis hosted on <code>bluespice.cloud</code>. See also section [[#Effects_of_disabling|Effects of disabling]].

=== Secure the evidence first ===

{{Textbox|boxtype=important|header='''Important:''' <code>docker compose down</code> removes the containers '''and their logs'''|text=The nginx access log of <code>wiki-web</code> is written to stdout, so it only exists in the Docker log of the container. Save the evidence '''before''' you restart anything|icon=yes}}

=== Detect an attack in the logs ===
Exploitation uses the parser function <code>#get_program_data</code>. It appears in the query string of requests to <code>api.php</code> or <code>index.php</code>.

'''Limits of this check. Please read.'''

* Only '''GET''' requests show the payload in the access log. The same attack also works via '''POST''', and POST bodies are not logged. Also look for:
** requests to <code>api.php</code> with <code>meta=siteinfo</code> and <code>siprop=extensions</code> (probing for ExternalData), followed by
** bursts of <code>POST /w/api.php</code> from the same IP within a few seconds.

* Attackers may URL-encode letters of the parser function name. If in doubt, run the decoded search on the whole log.
* A missing hit does '''not''' prove that no attack happened, for example if the logs were already rotated.

=== Mitigation: disable Extension:ExternalData ===
The extension is loaded by this line:<syntaxhighlight lang="php">
wfLoadExtension( 'ExternalData' );
</syntaxhighlight>Where it is:

* BlueSpice 4: <code>/app/bluespice/w/settings.d/050-BlueSpiceSemanticData.php</code>
* BlueSpice 5: <code>/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php</code>

The exact line number depends on the version.

'''Do not simply edit the file inside the running container.''' The change would be lost the next time the container is recreated. We recommend the following options, best first:

==== Mount a patched copy of the settings file ====
Copy the settings file out of the container, comment out the line and mount it read-only:<syntaxhighlight lang="bash">
# BlueSpice 5 – use 050-BlueSpiceSemanticData.php for BlueSpice 4
docker cp bluespice-wiki-web:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php ./
sed -i "s|^wfLoadExtension( 'ExternalData' );|#wfLoadExtension( 'ExternalData' ); #Disabled due to https://www.strix.ai/cve/CVE-2026-100382|" 040-BlueSpiceProDistribution.php
</syntaxhighlight><syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>'''Drawback:''' the copied file is tied to the exact image version. After an update it would overwrite the new version's file. Remove this mount before or together with the next update.

==== Effects of disabling ====
Pages that use <code>#get_web_data</code>, <code>#get_db_data</code>, <code>#external_value</code> or similar functions of ExternalData will show the parser function as plain text or no data until the extension is enabled again in a fixed version. No content is lost.

=== Recreate the container stack ===
A plain <code>restart</code> is '''not''' sufficient. It keeps the existing, possibly manipulated container file system. The containers must be removed and created again from the image:<syntaxhighlight lang="bash">
cd /path/to/bluespice-deploy/compose
./bluespice-deploy down
./bluespice-deploy up -d
</syntaxhighlight>{{Textbox|boxtype=important|header=|text='''Never''' use <code>down -v</code> or <code>down --volumes</code>. Also do not delete <code>${DATADIR}</code>. That would delete the persistent wiki data.|icon=yes}}Recreating the containers removes everything an attacker changed '''inside''' the containers. It does '''not''' clean the persistent data in <code>${DATADIR}</code> (database, uploads, configuration files on the volume). '''Verify''' that the extension is disabled:<syntaxhighlight lang="bash">
docker exec bluespice-wiki-web grep -rn "ExternalData" /app/bluespice/w/settings.d/
# Must NOT list "External Data":
curl -s "https://<your-wiki>/w/api.php?action=query&meta=siteinfo&siprop=extensions&format=json" | grep -i 'external data' \
|| echo "OK: ExternalData not loaded"
</syntaxhighlight>If <code>read</code> requires a login, run the API check in a logged-in browser session.

=== Check for compromise in persistent data ===
<code>DATADIR</code> refers to the value in <code>compose/.env</code>.

==== Files ====
To check whether uploaded files were replaced, compare the file hashes with a backup from '''before 2026-09-25''':

MediaWiki also stores a SHA-1 of every file version in the database (<code>img_sha1</code>, base-36). <code>php maintenance/run.php checkImages</code> in <code>wiki-task</code> reports files whose size does not match the database.

==== Database ====
Direct database changes bypass the wiki log. Changes made through the wiki (edits, uploads) show up in <code>Special:RecentChanges</code> and <code>Special:Log</code>. '''MySQL/MariaDB logs:''' the database logs are in <code>${DATADIR}/database/logs</code>. Check whether binary logs (<code>log_bin</code>) or the general query log are enabled

If binary logs exist, save them to the evidence directory and analyse the exposure window. Binary logs only record writes. Reads (data theft) cannot be seen there.

=== If you found traces of compromise ===

# Remove found web shells and restore manipulated files from a backup created '''before 2026-09-25'''. Put <code>pre-/post-init-settings.php</code> and <code>.wikienv</code> back to known-good content.
# '''Rotate all secrets''':
#* DB passwords (<code>DB_PASS</code>, <code>DB_ROOT_PASS</code>). Change them in the database '''and''' in <code>compose/.env</code>.
#* All files in <code>${DATADIR}/.secrets/</code>, for example with <code>openssl rand -hex 32 > …</code> per file.
#* OAuth key pair (<code>oauth_private.key</code>/<code>oauth_public.key</code>), SAML SP certificate (<code>simplesamlphp/certs</code>)
#* SMTP, LDAP/AD bind account, search credentials, API keys of AI providers, Slack/Teams/Rocket.Chat tokens
#* Passwords of all administrators. Ask all users to change their passwords. Also have them re-enroll two-factor authentication, because the TOTP secrets may be exposed.
# '''Invalidate all sessions''': add this to <code>post-init-settings.php</code>:
#: <code>$GLOBALS['wgAuthenticationTokenVersion'] = "2";</code>
#: Then recreate the stack. This logs out everybody.
# Remove any backdoor accounts, bot passwords and OAuth consumers you found. Revert manipulated interface pages.
# Check the host and the network for unusual activity: outgoing connections of the Docker host, firewall logs and access to internal systems from the Docker network.

=== See also ===

* [https://lists.wikimedia.org/hyperkitty/list/mediawiki-l@lists.wikimedia.org/thread/5N55R3XNFE7BXQLGWKZI7Q4ZXZSF4C5I/ Thread on <code>mediawiki-l</code> mailing list] - contains additional information about the issue

Security:Security Advisories/BSSA-2026-06

2026-09-28T14:59:15Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-09-28
|-
|Severity
|reported "critical", BlueSpice assessment: '''critical'''
|-
|Affected
|<code>bluespice/wiki</code> Docker image (all versions)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
|}

== Problem ==
{| class="wikitable" style="width: 100%;"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-100382
|<code>bluespice/wiki</code>
|Remote Code Execution
| style="" class="col-purple-bg" |affected
|}

== Impact assessment ==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-100382
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |Attackers with "read" permission can execute arbitrary commands in context of the <code>wiki-web</code> container
| style="vertical-align:middle;text-align:left;" |Deactivate Extension:ExternalData
|}

== Solution ==

=== Timeline and exposure window ===

* 2026-09-25: CVE published. A fix exists upstream in ExternalData 3.7.
* From 2026-09-26: mass automated scanning and exploitation, observed by us and other MediaWiki operators.
* Assume the exposure window runs '''from 2026-09-25 until the moment you applied the mitigation below'''.

=== 2. Secure the evidence first ===

{{Textbox|boxtype=important|header='''Important:''' <code>docker compose down</code> removes the containers '''and their logs'''|text=The nginx access log of <code>wiki-web</code> is written to stdout, so it only exists in the Docker log of the container. Save the evidence '''before''' you restart anything|icon=yes}}

=== 3. Detect an attack in the logs ===
Exploitation uses the parser function <code>#get_program_data</code>. It appears in the query string of requests to <code>api.php</code> or <code>index.php</code>.

'''Limits of this check. Please read.'''

* Only '''GET''' requests show the payload in the access log. The same attack also works via '''POST''', and POST bodies are not logged. Also look for:
** requests to <code>api.php</code> with <code>meta=siteinfo</code> and <code>siprop=extensions</code> (probing for ExternalData), followed by
** bursts of <code>POST /w/api.php</code> from the same IP within a few seconds.

* Attackers may URL-encode letters of the parser function name. If in doubt, run the decoded search on the whole log.
* A missing hit does '''not''' prove that no attack happened, for example if the logs were already rotated.

=== Mitigation: disable Extension:ExternalData ===
The extension is loaded by this line:<syntaxhighlight lang="php">
wfLoadExtension( 'ExternalData' );
</syntaxhighlight>Where it is:

* BlueSpice 4: <code>/app/bluespice/w/settings.d/050-BlueSpiceSemanticData.php</code>
* BlueSpice 5: <code>/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php</code>

The exact line number depends on the version.

'''Do not simply edit the file inside the running container.''' The change would be lost the next time the container is recreated. We recommend the following options, best first:

==== Mount a patched copy of the settings file ====
Copy the settings file out of the container, comment out the line and mount it read-only:<syntaxhighlight lang="bash">
# BlueSpice 5 – use 050-BlueSpiceSemanticData.php for BlueSpice 4
docker cp bluespice-wiki-web:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php ./
sed -i "s|^wfLoadExtension( 'ExternalData' );|#wfLoadExtension( 'ExternalData' ); #Disabled due to https://www.strix.ai/cve/CVE-2026-100382|" 040-BlueSpiceProDistribution.php
</syntaxhighlight><syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>'''Drawback:''' the copied file is tied to the exact image version. After an update it would overwrite the new version's file. Remove this mount before or together with the next update.

==== Effects of disabling ====
Pages that use <code>#get_web_data</code>, <code>#get_db_data</code>, <code>#external_value</code> or similar functions of ExternalData will show the parser function as plain text or no data until the extension is enabled again in a fixed version. No content is lost.

=== Recreate the container stack ===
A plain <code>restart</code> is '''not''' sufficient. It keeps the existing, possibly manipulated container file system. The containers must be removed and created again from the image:<syntaxhighlight lang="bash">
cd /path/to/bluespice-deploy/compose
./bluespice-deploy down
./bluespice-deploy up -d
</syntaxhighlight>{{Textbox|boxtype=important|header=|text='''Never''' use <code>down -v</code> or <code>down --volumes</code>. Also do not delete <code>${DATADIR}</code>. That would delete the persistent wiki data.|icon=yes}}Recreating the containers removes everything an attacker changed '''inside''' the containers. It does '''not''' clean the persistent data in <code>${DATADIR}</code> (database, uploads, configuration files on the volume). '''Verify''' that the extension is disabled:<syntaxhighlight lang="bash">
docker exec bluespice-wiki-web grep -rn "ExternalData" /app/bluespice/w/settings.d/
# Must NOT list "External Data":
curl -s "https://<your-wiki>/w/api.php?action=query&meta=siteinfo&siprop=extensions&format=json" | grep -i 'external data' \
|| echo "OK: ExternalData not loaded"
</syntaxhighlight>If <code>read</code> requires a login, run the API check in a logged-in browser session.

=== Check for compromise in persistent data ===
<code>DATADIR</code> refers to the value in <code>compose/.env</code>.

==== Files ====
To check whether uploaded files were replaced, compare the file hashes with a backup from '''before 2026-09-25''':

MediaWiki also stores a SHA-1 of every file version in the database (<code>img_sha1</code>, base-36). <code>php maintenance/run.php checkImages</code> in <code>wiki-task</code> reports files whose size does not match the database.

==== Database ====
Direct database changes bypass the wiki log. Changes made through the wiki (edits, uploads) show up in <code>Special:RecentChanges</code> and <code>Special:Log</code>. '''MySQL/MariaDB logs:''' the database logs are in <code>${DATADIR}/database/logs</code>. Check whether binary logs (<code>log_bin</code>) or the general query log are enabled

If binary logs exist, save them to the evidence directory and analyse the exposure window. Binary logs only record writes. Reads (data theft) cannot be seen there.

=== If you found traces of compromise ===

# Remove found web shells and restore manipulated files from a backup created '''before 2026-09-25'''. Put <code>pre-/post-init-settings.php</code> and <code>.wikienv</code> back to known-good content.
# '''Rotate all secrets''':
#* DB passwords (<code>DB_PASS</code>, <code>DB_ROOT_PASS</code>). Change them in the database '''and''' in <code>compose/.env</code>.
#* All files in <code>${DATADIR}/.secrets/</code>, for example with <code>openssl rand -hex 32 > …</code> per file.
#* OAuth key pair (<code>oauth_private.key</code>/<code>oauth_public.key</code>), SAML SP certificate (<code>simplesamlphp/certs</code>)
#* SMTP, LDAP/AD bind account, search credentials, API keys of AI providers, Slack/Teams/Rocket.Chat tokens
#* Passwords of all administrators. Ask all users to change their passwords. Also have them re-enroll two-factor authentication, because the TOTP secrets may be exposed.
# '''Invalidate all sessions''': add this to <code>post-init-settings.php</code>:
#: <code>$GLOBALS['wgAuthenticationTokenVersion'] = "2";</code>
#: Then recreate the stack. This logs out everybody.
# Remove any backdoor accounts, bot passwords and OAuth consumers you found. Revert manipulated interface pages.
# Check the host and the network for unusual activity: outgoing connections of the Docker host, firewall logs and access to internal systems from the Docker network.

Security:Security Advisories

2026-09-28T14:37:52Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
|[[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]]
|2026-09-28
|Security vulnerability in ExternalData extension
|[https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
|Remote code execution
| style="" class="col-purple-bg" |Critical
|-
|[[Security:Security Advisories/BSSA-2026-05|BSSA-2026-05]]
|2026-07-27
|Security vulnerabilities in containers and extensions
|[https://nvd.nist.gov/vuln/detail/CVE-2026-59933 CVE-2026-59933], [https://nvd.nist.gov/vuln/detail/CVE-2025-14813 CVE-2025-14813], [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896], [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
|Uncontrolled ressource consumption, infinite loop
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-04|BSSA-2026-04]]
|2026-06-22
|Security vulnerabilities in Confluence Migration Tool container image
|[https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|Heap buffer overflow vulnerability in Perl Regexes
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-06

2026-09-28T14:37:25Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-09-28
|-
|Severity
|reported "critical", BlueSpice assessment: '''critical'''
|-
|Affected
|<code>bluespice/wiki</code> Docker image (all versions)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
|}

== Problem ==
{| class="wikitable" style="width: 100%;"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-100382
|<code>bluespice/wiki</code>
|Remote Code Execution
| style="" class="col-purple-bg" |affected
|}

== Impact assessment ==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-100382
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |Attackers with "read" permission can execute arbitrary commands in context of the <code>wiki-web</code> container
| style="vertical-align:middle;text-align:left;" |Deactivate Extension:ExternalData
|}

== Solution ==

=== Timeline and exposure window ===

* 2026-09-25: CVE published. A fix exists upstream in ExternalData 3.7.
* From 2026-09-26: mass automated scanning and exploitation, observed by us and other MediaWiki operators.
* Assume the exposure window runs '''from 2026-09-25 until the moment you applied the mitigation below'''.

=== 2. Secure the evidence first ===

{{Textbox|boxtype=important|header='''Important:''' <code>docker compose down</code> removes the containers '''and their logs'''|text=The nginx access log of <code>wiki-web</code> is written to stdout, so it only exists in the Docker log of the container. Save the evidence '''before''' you restart anything|icon=yes}}

=== 3. Detect an attack in the logs ===
Exploitation uses the parser function <code>#get_program_data</code>. It appears in the query string of requests to <code>api.php</code> or <code>index.php</code>.

'''Limits of this check. Please read.'''

* Only '''GET''' requests show the payload in the access log. The same attack also works via '''POST''', and POST bodies are not logged. Also look for:
** requests to <code>api.php</code> with <code>meta=siteinfo</code> and <code>siprop=extensions</code> (probing for ExternalData), followed by
** bursts of <code>POST /w/api.php</code> from the same IP within a few seconds.

* Attackers may URL-encode letters of the parser function name. If in doubt, run the decoded search on the whole log.
* A missing hit does '''not''' prove that no attack happened, for example if the logs were already rotated.

=== Mitigation: disable Extension:ExternalData ===
The extension is loaded by this line:<syntaxhighlight lang="php">
wfLoadExtension( 'ExternalData' );
</syntaxhighlight>Where it is:

* BlueSpice 4: <code>/app/bluespice/w/settings.d/050-BlueSpiceSemanticData.php</code>
* BlueSpice 5: <code>/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php</code>

The exact line number depends on the version.

'''Do not simply edit the file inside the running container.''' The change would be lost the next time the container is recreated. We recommend the following options, best first:

==== Mount a patched copy of the settings file ====
Copy the settings file out of the container, comment out the line and mount it read-only:<syntaxhighlight lang="bash">
# BlueSpice 5 – use 050-BlueSpiceSemanticData.php for BlueSpice 4
docker cp bluespice-wiki-web:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php ./
sed -i "s|^wfLoadExtension( 'ExternalData' );|#wfLoadExtension( 'ExternalData' ); #Disabled due to https://www.strix.ai/cve/CVE-2026-100382|" 040-BlueSpiceProDistribution.php
</syntaxhighlight><syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>'''Drawback:''' the copied file is tied to the exact image version. After an update it would overwrite the new version's file. Remove this mount before or together with the next update. For this reason option B is preferred.

==== Effects of disabling ====
Pages that use <code>#get_web_data</code>, <code>#get_db_data</code>, <code>#external_value</code> or similar functions of ExternalData will show the parser function as plain text or no data until the extension is enabled again in a fixed version. No content is lost.

=== Recreate the container stack ===
A plain <code>restart</code> is '''not''' sufficient. It keeps the existing, possibly manipulated container file system. The containers must be removed and created again from the image:<syntaxhighlight lang="bash">
cd /path/to/bluespice-deploy/compose
./bluespice-deploy down
./bluespice-deploy up -d
</syntaxhighlight>{{Textbox|boxtype=important|header=|text='''Never''' use <code>down -v</code> or <code>down --volumes</code>. Also do not delete <code>${DATADIR}</code>. That would delete the persistent wiki data.|icon=yes}}Recreating the containers removes everything an attacker changed '''inside''' the containers. It does '''not''' clean the persistent data in <code>${DATADIR}</code> (database, uploads, configuration files on the volume). Check those as described in section 7. '''Verify''' that the extension is disabled:<syntaxhighlight lang="bash">
docker exec bluespice-wiki-web grep -rn "ExternalData" /app/bluespice/w/settings.d/
# Must NOT list "External Data":
curl -s "https://<your-wiki>/w/api.php?action=query&meta=siteinfo&siprop=extensions&format=json" | grep -i 'external data' \
|| echo "OK: ExternalData not loaded"
</syntaxhighlight>If <code>read</code> requires a login, run the API check in a logged-in browser session.

=== Check for compromise in persistent data ===
<code>DATADIR</code> refers to the value in <code>compose/.env</code>.

==== Files ====
To check whether uploaded files were replaced, compare the file hashes with a backup from '''before 2026-09-25''':

MediaWiki also stores a SHA-1 of every file version in the database (<code>img_sha1</code>, base-36). <code>php maintenance/run.php checkImages</code> in <code>wiki-task</code> reports files whose size does not match the database.

==== Database ====
Direct database changes bypass the wiki log. Changes made through the wiki (edits, uploads) show up in <code>Special:RecentChanges</code> and <code>Special:Log</code>. '''MySQL/MariaDB logs:''' the database logs are in <code>${DATADIR}/database/logs</code>. Check whether binary logs (<code>log_bin</code>) or the general query log are enabled

If binary logs exist, save them to the evidence directory and analyse the exposure window. Binary logs only record writes. Reads (data theft) cannot be seen there.

=== If you found traces of compromise ===

# Remove found web shells and restore manipulated files from a backup created '''before 2026-09-25'''. Put <code>pre-/post-init-settings.php</code> and <code>.wikienv</code> back to known-good content.
# '''Rotate all secrets''':
#* DB passwords (<code>DB_PASS</code>, <code>DB_ROOT_PASS</code>). Change them in the database '''and''' in <code>compose/.env</code>.
#* All files in <code>${DATADIR}/.secrets/</code>, for example with <code>openssl rand -hex 32 > …</code> per file.
#* OAuth key pair (<code>oauth_private.key</code>/<code>oauth_public.key</code>), SAML SP certificate (<code>simplesamlphp/certs</code>)
#* SMTP, LDAP/AD bind account, search credentials, API keys of AI providers, Slack/Teams/Rocket.Chat tokens
#* Passwords of all administrators. Ask all users to change their passwords. Also have them re-enroll two-factor authentication, because the TOTP secrets may be exposed.
# '''Invalidate all sessions''': add this to <code>post-init-settings.php</code>:
#: <code>$GLOBALS['wgAuthenticationTokenVersion'] = "2";</code>
#: Then recreate the stack. This logs out everybody.
# Remove any backdoor accounts, bot passwords and OAuth consumers you found. Revert manipulated interface pages.
# Check the host and the network for unusual activity: outgoing connections of the Docker host, firewall logs and access to internal systems from the Docker network.

Security:Security Advisories/BSSA-2026-06

2026-09-28T13:44:18Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-09-28
|-
|Severity
|reported "critical", BlueSpice assessment: '''critical'''
|-
|Affected
|<code>bluespice/wiki</code> Docker image (all versions)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://access.redhat.com/security/cve/cve-2026-100382 CVE-2026-100382]
|}

== Problem ==
{| class="wikitable" style="width: 100%;"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-100382
|<code>bluespice/wiki</code>
|Remote Code Execution
| style="" class="col-purple-bg" |affected
|}

== Impact assessment ==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-100382
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |Attackers with "read" permission can execute arbitrary commands in context of the <code>wiki-web</code> container
| style="vertical-align:middle;text-align:left;" |Deactivate Extension:ExternalData
|}

== Solution ==

=== Timeline and exposure window ===

* 2026-09-25: CVE published. A fix exists upstream in ExternalData 3.7.
* From 2026-09-26: mass automated scanning and exploitation, observed by us and other MediaWiki operators.
* Assume the exposure window runs '''from 2026-09-25 until the moment you applied the mitigation below'''.

=== 2. Secure the evidence first ===

{{Textbox|boxtype=important|header='''Important:''' <code>docker compose down</code> removes the containers '''and their logs'''|text=The nginx access log of <code>wiki-web</code> is written to stdout, so it only exists in the Docker log of the container. Save the evidence '''before''' you restart anything|icon=yes}}

=== 3. Detect an attack in the logs ===
Exploitation uses the parser function <code>#get_program_data</code>. It appears in the query string of requests to <code>api.php</code> or <code>index.php</code>.

'''Limits of this check. Please read.'''

* Only '''GET''' requests show the payload in the access log. The same attack also works via '''POST''', and POST bodies are not logged. Also look for:
** requests to <code>api.php</code> with <code>meta=siteinfo</code> and <code>siprop=extensions</code> (probing for ExternalData), followed by
** bursts of <code>POST /w/api.php</code> from the same IP within a few seconds.

* Attackers may URL-encode letters of the parser function name. If in doubt, run the decoded search on the whole log.
* A missing hit does '''not''' prove that no attack happened, for example if the logs were already rotated.

=== Mitigation: disable Extension:ExternalData ===
The extension is loaded by this line:<syntaxhighlight lang="php">
wfLoadExtension( 'ExternalData' );
</syntaxhighlight>Where it is:

* BlueSpice 4: <code>/app/bluespice/w/settings.d/050-BlueSpiceSemanticData.php</code>
* BlueSpice 5: <code>/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php</code>

The exact line number depends on the version.

'''Do not simply edit the file inside the running container.''' The change would be lost the next time the container is recreated. We recommend the following options, best first:

==== Mount a patched copy of the settings file ====
Copy the settings file out of the container, comment out the line and mount it read-only:<syntaxhighlight lang="bash">
# BlueSpice 5 – use 050-BlueSpiceSemanticData.php for BlueSpice 4
docker cp bluespice-wiki-web:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php ./
sed -i "s|^wfLoadExtension( 'ExternalData' );|#wfLoadExtension( 'ExternalData' ); #Disabled due to https://www.strix.ai/cve/CVE-2026-100382|" 040-BlueSpiceProDistribution.php
</syntaxhighlight><syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>'''Drawback:''' the copied file is tied to the exact image version. After an update it would overwrite the new version's file. Remove this mount before or together with the next update. For this reason option B is preferred.

==== Effects of disabling ====
Pages that use <code>#get_web_data</code>, <code>#get_db_data</code>, <code>#external_value</code> or similar functions of ExternalData will show the parser function as plain text or no data until the extension is enabled again in a fixed version. No content is lost.

=== Recreate the container stack ===
A plain <code>restart</code> is '''not''' sufficient. It keeps the existing, possibly manipulated container file system. The containers must be removed and created again from the image:<syntaxhighlight lang="bash">
cd /path/to/bluespice-deploy/compose
./bluespice-deploy down
./bluespice-deploy up -d
</syntaxhighlight>{{Textbox|boxtype=important|header=|text='''Never''' use <code>down -v</code> or <code>down --volumes</code>. Also do not delete <code>${DATADIR}</code>. That would delete the persistent wiki data.|icon=yes}}Recreating the containers removes everything an attacker changed '''inside''' the containers. It does '''not''' clean the persistent data in <code>${DATADIR}</code> (database, uploads, configuration files on the volume). Check those as described in section 7. '''Verify''' that the extension is disabled:<syntaxhighlight lang="bash">
docker exec bluespice-wiki-web grep -rn "ExternalData" /app/bluespice/w/settings.d/
# Must NOT list "External Data":
curl -s "https://<your-wiki>/w/api.php?action=query&meta=siteinfo&siprop=extensions&format=json" | grep -i 'external data' \
|| echo "OK: ExternalData not loaded"
</syntaxhighlight>If <code>read</code> requires a login, run the API check in a logged-in browser session.

=== Check for compromise in persistent data ===
<code>DATADIR</code> refers to the value in <code>compose/.env</code>.

==== Files ====
To check whether uploaded files were replaced, compare the file hashes with a backup from '''before 2026-09-25''':

MediaWiki also stores a SHA-1 of every file version in the database (<code>img_sha1</code>, base-36). <code>php maintenance/run.php checkImages</code> in <code>wiki-task</code> reports files whose size does not match the database.

==== Database ====
Direct database changes bypass the wiki log. Changes made through the wiki (edits, uploads) show up in <code>Special:RecentChanges</code> and <code>Special:Log</code>. '''MySQL/MariaDB logs:''' the database logs are in <code>${DATADIR}/database/logs</code>. Check whether binary logs (<code>log_bin</code>) or the general query log are enabled

If binary logs exist, save them to the evidence directory and analyse the exposure window. Binary logs only record writes. Reads (data theft) cannot be seen there.

=== If you found traces of compromise ===

# Remove found web shells and restore manipulated files from a backup created '''before 2026-09-25'''. Put <code>pre-/post-init-settings.php</code> and <code>.wikienv</code> back to known-good content.
# '''Rotate all secrets''':
#* DB passwords (<code>DB_PASS</code>, <code>DB_ROOT_PASS</code>). Change them in the database '''and''' in <code>compose/.env</code>.
#* All files in <code>${DATADIR}/.secrets/</code>, for example with <code>openssl rand -hex 32 > …</code> per file.
#* OAuth key pair (<code>oauth_private.key</code>/<code>oauth_public.key</code>), SAML SP certificate (<code>simplesamlphp/certs</code>)
#* SMTP, LDAP/AD bind account, search credentials, API keys of AI providers, Slack/Teams/Rocket.Chat tokens
#* Passwords of all administrators. Ask all users to change their passwords. Also have them re-enroll two-factor authentication, because the TOTP secrets may be exposed.
# '''Invalidate all sessions''': add this to <code>post-init-settings.php</code>:
#: <code>$GLOBALS['wgAuthenticationTokenVersion'] = "2";</code>
#: Then recreate the stack. This logs out everybody.
# Remove any backdoor accounts, bot passwords and OAuth consumers you found. Revert manipulated interface pages.
# Check the host and the network for unusual activity: outgoing connections of the Docker host, firewall logs and access to internal systems from the Docker network.

Security:Security Advisories/BSSA-2026-06

2026-09-28T12:56:29Z

Rvogel1: Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-09-28 |- |Severity |reported "critical", BlueSpice assessment: '''critical''' |- |Affected |<code>bluespice/wiki</code> Docker image (all versions) |- |Fixed in |Unknown |- |CVE | * [https://access.redhat.com/security/cve/cve-2026-100382 CVE-2026-100382] |} == Problem == {| class="wikitable" style="width: 100%;" !'''CVE''' !'''Component''' !'''Type of vulnerability''' !'''BlueSpice 5''' |- |CVE-2026-100382 |<code>bluespice/wiki..."

Setup:Software Bill of Materials (SBOM)

2026-08-10T15:06:45Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|<code>pro</code>, <code>farm</code>, <code>free</code>
|-
|version
|e.g. <code>5.1</code>, <code>5.2.6</code>
|-
|service
|Services differ depending on edition and version. Common services are:
<code>wiki</code>, <code>proxy</code>, <code>cache</code>, <code>pdf</code>, <code>search</code>, <code>diagram</code>, ...
|}

=== Main application image ===
Pull the '''application image''' for the desired edition and version:
<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>

Inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):
<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>

Example output:
<syntaxhighlight lang="shell-session">
> oras discover docker.bluespice.com/bluespice-farm/wiki:5.2.6
docker.bluespice.com/bluespice-farm/wiki@sha256:c683b74003ebedf40f0aa6c66fe858619dcbb036eeb191d3afc4385c3779260b
└── application/vnd.cyclonedx+json
└── sha256:3d7b0eca2caad4ac8a2f9e939186183722f43923ebdf6c07e38bb1fe58454058
└── [annotations]
└── org.opencontainers.image.created: "2026-08-03T15:18:42Z"
</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment, e.g. <code>3d7b0e...58</code> from the example):
<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>

=== Companion service images ===
Pull the image for the desired version:
<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Inspect the attachments:
<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment)
<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

=== Perform a security scan ===
The previous commands have created a <code>sbom.json</code> file in the local directory. You can now scan it. Below is a scanning example for <code>trivy</code>:
<syntaxhighlight lang="bash">
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T14:12:27Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Example:<syntaxhighlight lang="shell-session">
> oras discover docker.bluespice.com/bluespice-farm/wiki:5.2.6
docker.bluespice.com/bluespice-farm/wiki@sha256:c683b74003ebedf40f0aa6c66fe858619dcbb036eeb191d3afc4385c3779260b
└── application/vnd.cyclonedx+json
└── sha256:3d7b0eca2caad4ac8a2f9e939186183722f43923ebdf6c07e38bb1fe58454058
└── [annotations]
└── org.opencontainers.image.created: "2026-08-03T15:18:42Z"

</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment, e.g. <code>3d7b0e...58</code> from the example):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T14:07:02Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T14:06:31Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy:0.72.0 \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T13:18:27Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha-string):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \ -v "$PWD:/work:ro" \ aquasec/trivy:0.72.0 \ sbom \ --severity CRITICAL \ --ignore-unfixed \ --exit-code 1 \ /work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T13:15:27Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com /bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com /bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha-string):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com /bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \ -v "$PWD:/work:ro" \ aquasec/trivy:0.72.0 \ sbom \ --severity CRITICAL \ --ignore-unfixed \ --exit-code 1 \ /work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Installation Guide/Docker

2026-08-04T06:02:34Z

Rvogel1:

== Overview ==
Starting with version 4.5, BlueSpice MediaWiki can be installed with a stack of Docker container images.

Everything is built in a modular way to allow different types of setups.

The most common cases are:
# "All-in-one" (with and without Let's Encrypt)
# Custom database and search service
# Custom load balancer / proxy

== Architecture ==
<drawio filename="Setup:Installation_Guide_Docker-Achitecture" alt="Diagram of BlueSpice Docker Stack Architecture" />

'''Notes'''
* Internal HTTP connections may use non-standard ports. Those are noted next to the respective services.
** HTTP (in-secure) is only used for internal communication within the virtual network the stack is operated in. All connections to the client use TLS.
* Proprietary ports (esp. for database connections) are noted next to the respective services.
* There may be additional services and ports in use, based on the setup. Some examples:
** When using LDAP based authentication an LDAPS connection (port <code>636</code>) is used from the <code>bluespice/wiki</code> containers to the LDAP-Server
** When using Kerberos authentication, a connection (port <code>88</code>) is used from the <code>bluespice/kerberos-proxy</code> containers to the Kerberos-Server
** When using DeepL or OpenAI services, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> containers to to the respective service
** When using OpenIDConnect authentication, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> "task" container to to the authentication provider
** When using "Let's Encrypt" Certbot, a HTTPS connection (port <code>443</code>) is used from the <code>acme-companion</code> container to the "Let's Encrypt" service

== Step 1: Get the stack ==
Load project <code>bluespice-deploy</code> from https://github.com/hallowelt/bluespice-deploy/releases/latest and enter the sub-directory <code>compose</code> for Docker Compose files.

For example, run:
<syntaxhighlight lang="sh">
wget https://github.com/hallowelt/bluespice-deploy/archive/refs/tags/5.2.6.zip \
&& unzip 5.2.6.zip \
&& cd bluespice-deploy-5.2.6/compose
</syntaxhighlight>
{{Textbox|boxtype=note|header=Use one consistent version number|text=The tag number 5.2.5 in this command (could be 5.1.9, 5.2.4 etc. as well) should also be used as the <code>VERSION=</code> number in Step 2.|icon=yes}}

The directory contains the following files:
{| class="wikitable"
|+
! style="width:375px;" |Filename
! style="" |Type
! style="" |Comment
|-
| style="width:375px;" |<code>bluespice-deploy</code>
| style="" |shell script
| style="" |Start-up script, wrapping command <code>docker compose</code> and service <code>yml</code> files.<br>Additional service <code>yml</code> files can be loaded by adding <code>-f <filename> </code>.
|-
| style="width:375px;" |<code>docker-compose.main.yml</code>
| style="" |yml
| style="" |Main containers of the wiki (<code>wiki-web</code> and <code>wiki-task</code>).
|-
| style="width:375px;" |<code>docker-compose.persistent-data-services.yml</code>
| style="" |yml
| style="" |Containers of database and search services, storing persistent data onto the file system.<br />Optionally with external MySQL/MariaDB and OpenSearch one can skip loading this <code>.yml</code> in <code>bluespice-deploy</code>. Please then wire your services properly in the <code>.env</code> file.
|-
| style="width:375px;" |<code>docker-compose.stateless-services.yml</code>
| style="" |yml
| style="" |Containers for caching, PDF rendering, formula-rendering and diagram editing.
|-
| style="width:375px;" |<code>docker-compose.helper-service.yml</code>
| style="" |yml
| style="" |Helper containers for file system preparation and automated BlueSpice upgrade.<br>These containers exit automatically after finishing tasks.
|-
| style="width:375px;" |<code>docker-compose.proxy.yml</code>
| style="" |yml
| style="" |Container of proxy service. Can be replaced by existing proxy/load-balancer infrastructure.
|-
| style="width:375px;" |<code>docker-compose.proxy-letsencrypt.yml</code>
| style="" |yml
| style="" |Additional service for auto-renewal of "Let's Encrypt" certificates.<br>Only required when using the Let's Encrypt service and having no other TLS termination.
|-
| style="width:375px;" |<code>docker-compose.kerberos-proxy.yml</code>
| style="" |yml
| style="" |Additional proxy for Kerberos based authentication.
|-
| style="width:375px;" |<code>docker-compose.collabpads-service.yml</code>
|yml
|Containers of back-end services for [[Manual:Extension/CollabPads|CollabPads]] (included in Pro and Farm editions).
|-
| style="width:375px;" |<code>.env.sample</code>
| style="" |text
| style="" |Sample for creating <code>.env</code> that defines key environment variables.
|-
| style="width:375px;" |<code>bluespice.service.demo</code>
| style="" |service script
| style="" |Demo-file for control the BlueSpice stack as a <code>systemctl</code> service.<br>One can create e.g a <code>/etc/systemd/system/bluespice.service</code>.
|}

== Step 2: Set up environment variables ==
Create your <code>.env</code> based on the sample file <code>.env.sample</code>.

Example:
<pre>
# set or use your data directory
DATADIR=/data/bluespice
VERSION=5.2.5
EDITION=free
BACKUP_HOUR=04

WIKI_NAME=BlueSpice
WIKI_LANG=en
WIKI_PASSWORDSENDER=no-reply@wiki.company.local
WIKI_EMERGENCYCONTACT=no-reply@wiki.company.local
WIKI_HOST=wiki.company.local
WIKI_PORT=443
WIKI_PROTOCOL=https
WIKI_BASE_PATH=

DB_USER=set_or_use_your_db_user_name
DB_PASS=SET_OR_USE_YOUR_DB_PASS_WORD
DB_ROOT_USER=root
DB_ROOT_PASS=$DB_PASS
DB_HOST=database
DB_NAME=bluespice
DB_PREFIX=

SMTP_HOST=mail.company.local
SMTP_PORT=25
SMTP_USER=...
SMTP_PASS=...
SMTP_ID_HOST=...

LETSENCRYPT=false
</pre>
{{Textbox|boxtype=note|header=Different editions|text=This config works for all editions, but the main image of Pro or Farm edition needs to be obtained differently, see [[{{FULLPAGENAME}}/Pro and Farm edition|Pro and Farm edition]]|icon=yes}}

== Step 3: Start the stack ==
Use <code>bluespice-deploy up -d</code> to start the stack. Once all containers are shown as "ready" you can navigate to <code>$WIKI_PROTOCOL://$WIKI_HOST:$WIKI_PORT</code> (e.g. <code><nowiki>https://wiki.company.local</nowiki></code>) in your preferred web browser and start using the application.

When starting the stack the first time, the <code>wiki-task</code> container will automatically perform the installation. It may take a couple of minutes for the process to set up the database and complete. Once it is finished, the password for the default <code>Admin</code> user can be found in <code>$DATADIR/wiki/initialAdminPassword</code>.

== Additional options ==

=== Add Customizations to containers ===
Since tag 5.1.4 and tag 5.2.0 of project <code>bluespice-deploy</code>, we allow to edit and maintain a separate <code>docker-compose.override.yml</code> which will be ignored by git.

This way you can add your own Container-Configurations and be able to maintain your git status up to date. Just place the file next to the other <code>docker-compose.*.yml</code> s and run <code>./bluespice-deploy up -d</code>.

Example:<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- /backup/:/data/backup
wiki-task:
volumes:
- /backup/:/data/backup
</syntaxhighlight>

=== Configs for <code>LocalSettings.php</code> ===
Instead of exposing the <code>LocalSettings.php</code> for [[mediawikiwiki:Manual:LocalSettings.php|adding additional configurations]], the stack offers two entry points. After the initial installation, you can add your configs to two files in <code>${DATADIR}/wiki/bluespice/</code>:

* <code>pre-init-settings.php</code> - Set configs before the initialization of BlueSpice's debug logging, libraries, skins, extensions and default settings. Configs set here can be picked up by the init process.
* <code>post-init-settings.php</code> - Set configs after the initialization, manipulating configs that have been set by the init process.
For example, if you add the following lines to <code>pre-init-settings.php</code>, you can then read outputted debug logs (if any) in <code>${DATADIR}/wiki/bluespice/logs/debug.log</code>:<syntaxhighlight lang="php">
$GLOBALS['bsgDebugLogGroups']['exception'] = "/data/bluespice/logs/debug.log";
$wgShowExceptionDetails = true;
</syntaxhighlight>

=== Maintenance scripts ===
To run [[Setup:Installation Guide/Advanced/Maintenance scripts|maintenance scripts]] from MediaWiki or from other extensions, please use the <code>wiki-task</code> container, which handles all back-end jobs and processes. You can connect into the container in two different ways:

* run <code>./bluespice-deploy exec -it wiki-task bash</code> in the <code>compose</code> directory for Docker Compose files
* or alternatively, run <code>docker exec -it bluespice-wiki-task bash</code> wherever you are on the host machine

Inside the container you can enter the wiki's code base with <code>cd /app/bluespice/w</code> , where one can run scripts like <code>php maintenance/run.php update --quick</code>, <code>php extensions/BlueSpiceExtendedSearch/maintenance/updateWikiPageIndex.php</code> and so on.

=== SSL certificates ===
To use a Let's Encrypt certificate for your domain name, set <code>LETSENCRYPT=true</code> in your <code>.env</code> file.

To use a self-signend certificate for your domain name, put its <code>.crt</code> and <code>.key</code> files in <code>${DATADIR}/proxy/certs</code>. For example, with <code>wiki.company.local</code> you should prepare <code>wiki.company.local.crt</code> and <code>wiki.company.local.key</code> files.

=== Kerberos proxy ===
For implicit authentication using Kerberos, an additional proxy must be used: <code>bluespice/kerberos-proxy</code> . The file <code>docker-compose.kerberos-proxy.yml</code> contains a common configuration. It can be used '''instead of''' the regular <code>docker-compose.proxy.yml</code> file inside <code>bluespice-deploy</code> .

Make sure to have the files

* <code>${DATADIR}/kerberos/krb5.conf</code>
* <code>${DATADIR}/kerberos/kerberos.keytab</code>

set up properly.

The file <code>${DATADIR}/wiki/bluespice/pre-init-settings.php</code> can then be used to set up [[mediawikiwiki:LDAP_hub|"Extension:Auth_remoteuser" and the LDAP stack extensions]].

=== SAML authentication ===
During the initial installation a certificate for message signing will automatically be created. It can be found in <code>${DATADIR}/wiki/simplesamlphp/certs/</code>.

In order to configure a remote IdP, one must copy the IdP metadata XML to a file called <code>${DATADIR}/wiki/simplesamlphp/saml_idp_metadata.xml</code>. The SP metadata can then be obtained via <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/saml/sp/metadata.php/default-sp</nowiki></code>. It must be configured in the remote IdP.

{{Textbox
|boxtype=tip
|header=Test authentication
|text= You can test authentication directly within the SimpleSAMLphp application. To do so, navigate to <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/admin</nowiki></code> and log in with <code>admin</code> and the <code>INTERNAL_SIMPLESAMLPHP_ADMIN_PASS</code> found in <code>${DATADIR}/wiki/.wikienv</code>
|icon=yes
}}

Next, the extensions "PluggableAuth" and "SimpleSAMLphp" must be enabled on the wiki. To do so, add

<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'SimpleSAMLphp'
] );
</syntaxhighlight>[[File:Setup:SAML ConfigManager EN 01.png|thumb|300x300px]]to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

=== OpenID Connect authentication ===

The extensions "PluggableAuth" and "OpenIDConnect" must be enabled on the wiki. To do so, add<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'OpenIDConnect'
] );
</syntaxhighlight>to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

[[de:Setup:Installationsanleitung/Docker]]

Reference:BlueSpiceInterwikiSearch

2026-07-31T13:06:41Z

Rvogel1:

{{BSExtensionInfo
|desc=Simultaneous search in multiple wikis
|status=stable
|developer=HalloWelt
|type=BlueSpice
|edition=BlueSpice pro (deactivated), BlueSpice farm (deactivated)
|compatible=BlueSpice
|license=GPL v3
|docu=Manual:Extension/BlueSpiceInterwikiSearch
|active=Yes
|features=
'''InterwikiSearch''' alows simultaneously searching other BlueSpice wikis.
==Usage / features==
If BlueSpiceInterwikiSearch is enabled and configured on the wiki, the <code>Special:SearchCenter</code>, shows results from other wikis. Results are shown as buttons on top of the results list.

==Technical information==
===Configuration===
To set up this service, wiki administrator must add following settings into LocalSettings.php:
<pre>
$GLOBALS['bsgBlueSpiceInterwikiSearch']['Wiki_name'] = [
"name" => "Wiki name", // Will be displayed as the wiki name in the results
"api-endpoint" => "http://other.wiki.com/w/api.php",
"search-on-wiki-url" => "http://other.wiki.com/wiki/Special:SearchCenter" // URL to the SearchCenter SpecialPage on target wiki
];
</pre>{{Messagebox|boxtype=note|Note text=This does not apply to [[Manual:Extension/BlueSpiceWikiFarm|BlueSpiceWikiFarm]] users, BlueSpiceInterwikiSearch within a WikiFarm is handled separately.}}

== Demo ==

Try out InterwikiSearch in our [https://en.demo.bluespice.com demo]
}}

{{wcagCheck
|wcagStatus=2-testing complete
|wcagCheckedfor=Web, Authoring tool
|wcagTestdate=2022-10-10
|wcagLevel=AA
|wcagSupport=partially supports
|wcagWorkaround=no
|wcagComments=Interwiki links are commonly not used. Only relevant for wikis that connect search to other wikis.

Web: screen reader needs label for interwiki search results announced. Ticket: erm30061

Authoring tool: Standard ext-js pagination issue: buttons not announced to screen readers.
|extensionType=extended
|extensionFocus=reader
}}

Security:Security Advisories/BSSA-2026-05

2026-07-27T12:50:07Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-07-27
|-
|Severity
|reported "high", BlueSpice assessment: '''not affected / low'''
|-
|Affected
|<code>bluespice/search</code> Docker image (all versions)
<code>bluespice/ai</code> Docker image (5.3.x)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://access.redhat.com/security/cve/cve-2025-14813 CVE-2025-14813]
* [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
* [https://advisories.gitlab.com/composer/phpoffice/phpspreadsheet/CVE-2026-59933/ CVE-2026-59933]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2025-14813
|<code>bluespice/search</code>
|Use of a Broken or Risky Cryptographic Algorithm
| style="" class="col-green-bg" |not affected
|-
|CVE-2025-65896
|<code>bluespice/ai</code>
|SQL Injection via dictionary as params
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-59873
|<code>bluespice/ai</code>, <code>bluespice/chat</code>, <code>bluespice/formula</code>, <code>bluespice/wire</code>
|Allocation of Resources Without Limits or Throttling
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-59933
|
* Extension:BlueSpiceUEModuleTable2Excel
* Extension:DataTransfer
* Extension:SemanticResultFormats
|
* Uncontrolled Resource Consumption
* Loop with Unreachable Exit Condition ('Infinite Loop')
| style="" class="col-orange-bg" |low
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-14813
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |The code is only used by Tika when processing Encrypted PDFs and Office files, which we don't support. In addition the code affected in particular is probably not used and the described attack vector ("capture ciphertext") and impact ("perform cryptanalysis and uncover the underlying data") is not applicable in this use case.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
|CVE-2025-65896
| style="" class="col-green-bg" |Asyncmy is only used as the DB API layer for SQLAlchemy to connect to MySQL, SQLAlchemy enforces a "format" parameter style, which only uses "%s" placeholder strings for SQL queries. This is opposed to inserting values via a dictionary, meaning no impact from this CVE is possible.
|No action required.
|-
|CVE-2026-59873
| style="" class="col-green-bg" |None of the code makes use of the affected package / code (<code>node-tar</code>). In all but <code>bluespice/formula</code> it is just part of the base image content. In <code>bluespice/formula</code>, it is a transient dependency, but also not used. Not even in the dependency code.
|No action required.
|-
|CVE-2026-59933
| style="" class="col-orange-bg" |Extension:BlueSpiceUEModuleTable2Excel and Extension:SemanticResultFormats don't use affected code at all. Only Extension:DataTransfer may be affected.
|If concerned temporarily disable Special:ImportSpreadsheet via <code>$DATA/wiki/bluespice/pre-init-settings.php</code>.
\Hooks::register( 'SpecialPage_initList', static function( &$specialPages ) {
unset( $list['ImportSpreadsheet'] );
});
|}

== Solution ==
No immediate action required. If concerned about CVE-2026-59933, apply the temporary fix. CVE-2026-59933 will be fixed in one of the next patch releases.

Security:Security Advisories/BSSA-2026-05

2026-07-27T09:45:17Z

Rvogel1:

Security:Security Advisories/BSSA-2026-05

2026-07-27T09:26:21Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-07-17
|-
|Severity
|reported "high", BlueSpice assessment: '''not affected'''
|-
|Affected
|<code>bluespice/search</code> Docker image (all versions)
<code>bluespice/ai</code> Docker image (5.3.x)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://access.redhat.com/security/cve/cve-2025-14813 CVE-2025-14813]
* [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2025-14813
|<code>bluespice/search</code>
|Use of a Broken or Risky Cryptographic Algorithm
| style="" class="col-green-bg" |not affected
|-
|CVE-2025-65896
|<code>bluespice/ai</code>
|SQL Injection via dictionary as params
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-59873
|<code>bluespice/ai</code>, <code>bluespice/chat</code>, <code>bluespice/formula</code>, <code>bluespice/wire</code>
|Allocation of Resources Without Limits or Throttling
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-14813
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |The code is only used by Tika when processing Encrypted PDFs and Office files, which we don't support. In addition the code affected in particular is probably not used and the described attack vector ("capture ciphertext") and impact ("perform cryptanalysis and uncover the underlying data") is not applicable in this use case.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
|CVE-2025-65896
| style="" class="col-green-bg" |Asyncmy is only used as the DB API layer for SQLAlchemy to connect to MySQL, SQLAlchemy enforces a "format" parameter style, which only uses "%s" placeholder strings for SQL queries. This is opposed to inserting values via a dictionary, meaning no impact from this CVE is possible.
|No action required.
|-
|CVE-2026-59873
| style="" class="col-green-bg" |None of the code makes use of the affected package / code (<code>node-tar</code>). In all but <code>bluespice/formula</code> it is just part of the base image content. In <code>bluespice/formula</code>, it is a transient dependency, but also not used. Not even in the dependency code.
|No action required.
|}

== Solution ==
No immediate action required.

Security:Security Advisories/BSSA-2026-05

2026-07-17T13:39:04Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-07-17
|-
|Severity
|reported "high", BlueSpice assessment: '''not affected'''
|-
|Affected
|<code>bluespice/search</code> Docker image (all versions)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://access.redhat.com/security/cve/cve-2025-14813 CVE-2025-14813]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2025-14813
|<code>bluespice/search</code>
|Use of a Broken or Risky Cryptographic Algorithm
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-14813
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |The code is only used by Tika when processing Encrypted PDFs and Office files, which we don't support. In addition the code affected in particular is probably not used and the described attack vector ("capture ciphertext") and impact ("perform cryptanalysis and uncover the underlying data") is not applicable in this use case.
| style="vertical-align:middle;text-align:left;" |No action required.
|}

== Solution ==
No immediate action required.

Security:Security Advisories/BSSA-2026-05

2026-07-17T13:36:47Z

Rvogel1: Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-06-22 |- |Severity |reported "high", BlueSpice assessment: '''not affected''' |- |Affected |<code>bluespice/migrate-confluence</code> Docker image (all versions) |- |Fixed in |Next regular update |- |CVE | * [https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376] |} ==Problem== {| class="wikitable" !'''CVE''' !'''Component''' !'''Type of vulnerability''' !'''BlueSpice 5''' |- |CVE-2026-8376 |<code>bluespice/migrate-confl..."

{| class="wikitable"
|+
!
!
|-
|Date
|2026-06-22
|-
|Severity
|reported "high", BlueSpice assessment: '''not affected'''
|-
|Affected
|<code>bluespice/migrate-confluence</code> Docker image (all versions)
|-
|Fixed in
|Next regular update
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-8376
|<code>bluespice/migrate-confluence</code>
|Heap Buffer Overflow (Perl regex compilation, 32-bit only)
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-8376
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. The vulnerability only applies to 32-bit Perl builds; the <code>bluespice/migrate-confluence</code> Docker image uses a 64-bit base image and therefore runs a 64-bit Perl. Additionally, the regular expressions used in the application are part of the application logic and cannot be injected by an attacker.
| style="vertical-align:middle;text-align:left;" |No action required.
|}

== Solution ==
No immediate action required. The affected library will be updated in the next regular release.

Development/SAML 2.0 IdP

2026-07-14T11:34:22Z

Rvogel1:

Create the following files and folders within your <code>$DATADIR</code>
<syntaxhighlight lang="text">
└── saml-idp
├── saml-config.php
├── saml-sp-metadata.php
└── saml-users.php

</syntaxhighlight>

Add the following content to the files

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-config.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/config.php

$idPbaseUrl = 'https://' . getenv( 'DEV_SHARED_IDP_HOST' );
$config = [
'baseurlpath' => $idPbaseUrl . '/_samlidp/simplesaml/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
'tempdir' => '/tmp/simplesaml',
'debug' => true,
'showerrors' => true,
'errorreporting' => true,
'debug.validatexml' => false,
'auth.adminpassword' => 'secret',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
'secretsalt' => 'defaultsecretsalt',
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.invalid',
'timezone' => NULL,
'logging.level' => SimpleSAML_Logger::DEBUG,
'logging.handler' => 'errorlog',
'logging.facility' => 168,
'logging.processname' => 'simplesamlphp',
'logging.logfile' => 'simplesamlphp.log',
'statistics.out' => [],
'database.dsn' => 'mysql:host=localhost;dbname=saml',
'database.username' => 'simplesamlphp',
'database.password' => 'secret',
'database.prefix' => '',
'database.persistent' => false,
'database.slaves' => [],
'enable.saml20-idp' => true,
'enable.shib13-idp' => true,
'enable.adfs-idp' => false,
'enable.wsfed-sp' => false,
'enable.authmemcookie' => false,
'session.duration' => 28800,
'session.datastore.timeout' => 14400,
'session.state.timeout' => 3600,
'session.cookie.name' => 'SimpleSAMLSessionIDIdp',
'session.cookie.lifetime' => 0,
'session.cookie.path' => '/',
'session.cookie.domain' => NULL,
'session.cookie.secure' => false,
'enable.http_post' => false,
'session.phpsession.cookiename' => 'PHPSESSIDIDP',
'session.phpsession.savepath' => NULL,
'session.phpsession.httponly' => true,
'session.authtoken.cookiename' => 'SimpleSAMLAuthTokenIdp',
'session.rememberme.enable' => false,
'session.rememberme.checked' => false,
'session.rememberme.lifetime' => 1209600,
'language.available' =>
[
0 => 'en',
1 => 'no',
2 => 'nn',
3 => 'se',
4 => 'da',
5 => 'de',
6 => 'sv',
7 => 'fi',
8 => 'es',
9 => 'fr',
10 => 'it',
11 => 'nl',
12 => 'lb',
13 => 'cs',
14 => 'sl',
15 => 'lt',
16 => 'hr',
17 => 'hu',
18 => 'pl',
19 => 'pt',
20 => 'pt-br',
21 => 'tr',
22 => 'ja',
23 => 'zh',
24 => 'zh-tw',
25 => 'ru',
26 => 'et',
27 => 'he',
28 => 'id',
29 => 'sr',
30 => 'lv',
31 => 'ro',
32 => 'eu',
],
'language.rtl' =>
[
0 => 'ar',
1 => 'dv',
2 => 'fa',
3 => 'ur',
4 => 'he',
],
'language.default' => 'en',
'language.parameter.name' => 'language',
'language.parameter.setcookie' => true,
'language.cookie.name' => 'language',
'language.cookie.domain' => NULL,
'language.cookie.path' => '/',
'language.cookie.lifetime' => 77760000,
'attributes.extradictionary' => NULL,
'theme.use' => 'default',
'default-wsfed-idp' => 'urn:federation:pingfederate:localhost',
'idpdisco.enableremember' => true,
'idpdisco.rememberchecked' => true,
'idpdisco.validate' => true,
'idpdisco.extDiscoveryStorage' => NULL,
'idpdisco.layout' => 'dropdown',
'shib13.signresponse' => true,
'authproc.idp' =>
[
30 => 'core:LanguageAdaptor',
45 =>
[
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
],
50 => 'core:AttributeLimit',
99 => 'core:LanguageAdaptor',
],
'authproc.sp' =>
[
90 => 'core:LanguageAdaptor',
],
'metadata.sources' =>
[
[
'type' => 'flatfile',
],
],
'store.type' => 'phpsession',
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
'store.sql.username' => NULL,
'store.sql.password' => NULL,
'store.sql.prefix' => 'SimpleSAMLphp',
'memcache_store.servers' =>
[
[
[
'hostname' => 'localhost',
],
],
],
'memcache_store.prefix' => NULL,
'memcache_store.expires' => 129600,
'metadata.sign.enable' => false,
'metadata.sign.privatekey' => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
'proxy' => NULL,
'trusted.url.domains' => [],
];</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-sp-metadata.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-users.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php

$pass = getenv( 'DB_ROOT_PASS' );

$config = [
'admin' => [
'core:AdminPassword',
],
'example-userpass' => [
// First element must be a string which identifies the authentication source.
'exampleauth:UserPass',

"alice@example.invalid:$pass" => [
'username' => [ 'alice@example.invalid' ],
'name' => [ 'Alice' ],
'email' => [ 'alice@example.invalid' ],
'groups' => [ 'wiki-contributor', 'wiki-admin' ]
],
"bob@example.invalid:$pass" => [
'username' => [ 'bob@example.invalid' ],
'name' => [ 'Bob' ],
'email' => [ 'bob@example.invalid' ],
'groups' => [ 'wiki-contributor' ]
],
"charlie@example.invalid:$pass" => [
'username' => [ 'charlie@example.invalid' ],
'name' => [ 'Charlie' ],
'email' => [ 'charlie@example.invalid' ],
'groups' => [ 'wiki-admin' ]
]
],
];</syntaxhighlight></div>
</div>

In your <code>docker-compose.override.yml</code> add<syntaxhighlight lang="yaml">
samlidp:
image: kristophjunge/test-saml-idp
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
volumes:
- ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
- ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
- ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_samlidp/
VIRTUAL_PORT: 8080
VIRTUAL_DEST: /
DEV_SHARED_IDP_HOST: ${WIKI_HOST}
DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
restart: no
</syntaxhighlight>
After starting the stack with <code>./bluespice-deploy up -d</code> you can
* access the IdP via https://localhost/_samlidp/simplesaml/module.php/core/frontpage_welcome.php (metadata at https://localhost/_samlidp/simplesaml/saml2/idp/metadata.php )
* test authentication on the SP via https://localhost/_sp/module.php/admin/test/default-sp (metadata at https://localhost/_sp/module.php/saml/sp/metadata/default-sp )

To wire your wiki application, create a new file <code>settings.d/099-SAML-dev.local.php</code> within your <code>$CODEDIR</code>
<syntaxhighlight lang="php"><?php

$GLOBALS['wgExtensionFunctions'][] = function () {
$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
'plugin' => 'SimpleSAMLphp',
'data' => [
'authSourceId' => 'default-sp',
'usernameAttribute' => 'name',
'realNameAttribute' => 'name',
'emailAttribute' => 'email'
],
'groupsyncs' => [
[
'type' => 'mapped',
'map' => [
'editor' => [
'groups' => 'wiki-contributor'
],
'sysop' => [
'groups' => 'wiki-admin'
]
]
]
]

];
};
</syntaxhighlight>

Development/SAML 2.0 IdP

2026-07-14T11:33:17Z

Rvogel1:

Create the following files and folders within your <code>$DATADIR</code>
<syntaxhighlight lang="text">
└── saml-idp
├── saml-config.php
├── saml-sp-metadata.php
└── saml-users.php

</syntaxhighlight>

Add the following content to the files

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-config.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/config.php

$idPbaseUrl = 'https://' . getenv( 'DEV_SHARED_IDP_HOST' );
$config = [
'baseurlpath' => $idPbaseUrl . '/_samlidp/simplesaml/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
'tempdir' => '/tmp/simplesaml',
'debug' => true,
'showerrors' => true,
'errorreporting' => true,
'debug.validatexml' => false,
'auth.adminpassword' => 'secret',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
'secretsalt' => 'defaultsecretsalt',
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.invalid',
'timezone' => NULL,
'logging.level' => SimpleSAML_Logger::DEBUG,
'logging.handler' => 'errorlog',
'logging.facility' => 168,
'logging.processname' => 'simplesamlphp',
'logging.logfile' => 'simplesamlphp.log',
'statistics.out' => [],
'database.dsn' => 'mysql:host=localhost;dbname=saml',
'database.username' => 'simplesamlphp',
'database.password' => 'secret',
'database.prefix' => '',
'database.persistent' => false,
'database.slaves' => [],
'enable.saml20-idp' => true,
'enable.shib13-idp' => true,
'enable.adfs-idp' => false,
'enable.wsfed-sp' => false,
'enable.authmemcookie' => false,
'session.duration' => 28800,
'session.datastore.timeout' => 14400,
'session.state.timeout' => 3600,
'session.cookie.name' => 'SimpleSAMLSessionIDIdp',
'session.cookie.lifetime' => 0,
'session.cookie.path' => '/',
'session.cookie.domain' => NULL,
'session.cookie.secure' => false,
'enable.http_post' => false,
'session.phpsession.cookiename' => 'PHPSESSIDIDP',
'session.phpsession.savepath' => NULL,
'session.phpsession.httponly' => true,
'session.authtoken.cookiename' => 'SimpleSAMLAuthTokenIdp',
'session.rememberme.enable' => false,
'session.rememberme.checked' => false,
'session.rememberme.lifetime' => 1209600,
'language.available' =>
[
0 => 'en',
1 => 'no',
2 => 'nn',
3 => 'se',
4 => 'da',
5 => 'de',
6 => 'sv',
7 => 'fi',
8 => 'es',
9 => 'fr',
10 => 'it',
11 => 'nl',
12 => 'lb',
13 => 'cs',
14 => 'sl',
15 => 'lt',
16 => 'hr',
17 => 'hu',
18 => 'pl',
19 => 'pt',
20 => 'pt-br',
21 => 'tr',
22 => 'ja',
23 => 'zh',
24 => 'zh-tw',
25 => 'ru',
26 => 'et',
27 => 'he',
28 => 'id',
29 => 'sr',
30 => 'lv',
31 => 'ro',
32 => 'eu',
],
'language.rtl' =>
[
0 => 'ar',
1 => 'dv',
2 => 'fa',
3 => 'ur',
4 => 'he',
],
'language.default' => 'en',
'language.parameter.name' => 'language',
'language.parameter.setcookie' => true,
'language.cookie.name' => 'language',
'language.cookie.domain' => NULL,
'language.cookie.path' => '/',
'language.cookie.lifetime' => 77760000,
'attributes.extradictionary' => NULL,
'theme.use' => 'default',
'default-wsfed-idp' => 'urn:federation:pingfederate:localhost',
'idpdisco.enableremember' => true,
'idpdisco.rememberchecked' => true,
'idpdisco.validate' => true,
'idpdisco.extDiscoveryStorage' => NULL,
'idpdisco.layout' => 'dropdown',
'shib13.signresponse' => true,
'authproc.idp' =>
[
30 => 'core:LanguageAdaptor',
45 =>
[
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
],
50 => 'core:AttributeLimit',
99 => 'core:LanguageAdaptor',
],
'authproc.sp' =>
[
90 => 'core:LanguageAdaptor',
],
'metadata.sources' =>
[
[
'type' => 'flatfile',
],
],
'store.type' => 'phpsession',
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
'store.sql.username' => NULL,
'store.sql.password' => NULL,
'store.sql.prefix' => 'SimpleSAMLphp',
'memcache_store.servers' =>
[
[
[
'hostname' => 'localhost',
],
],
],
'memcache_store.prefix' => NULL,
'memcache_store.expires' => 129600,
'metadata.sign.enable' => false,
'metadata.sign.privatekey' => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
'proxy' => NULL,
'trusted.url.domains' => [],
];
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-sp-metadata.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-users.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php

$pass = getenv( 'DB_ROOT_PASS' );

$config = [
'admin' => [
'core:AdminPassword',
],
'example-userpass' => [
// First element must be a string which identifies the authentication source.
'exampleauth:UserPass',

"alice@example.invalid:$pass" => [
'username' => [ 'alice@example.invalid' ],
'name' => [ 'Alice' ],
'email' => [ 'alice@example.invalid' ],
'groups' => [ 'wiki-contributor', 'wiki-admin' ]
],
"bob@example.invalid:$pass" => [
'username' => [ 'bob@example.invalid' ],
'name' => [ 'Bob' ],
'email' => [ 'bob@example.invalid' ],
'groups' => [ 'wiki-contributor' ]
],
"charlie@example.invalid:$pass" => [
'username' => [ 'charlie@example.invalid' ],
'name' => [ 'Charlie' ],
'email' => [ 'charlie@example.invalid' ],
'groups' => [ 'wiki-admin' ]
]
],
];</syntaxhighlight></div>
</div>

In your <code>docker-compose.override.yml</code> add<syntaxhighlight lang="yaml">
samlidp:
image: kristophjunge/test-saml-idp
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
volumes:
- ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
- ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
- ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_samlidp/
VIRTUAL_PORT: 8080
VIRTUAL_DEST: /
DEV_SHARED_IDP_HOST: ${WIKI_HOST}
DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
restart: no
</syntaxhighlight>
After starting the stack with <code>./bluespice-deploy up -d</code> you can
* access the IdP via https://localhost/_samlidp/simplesaml/module.php/core/frontpage_welcome.php (metadata at https://localhost/_samlidp/simplesaml/saml2/idp/metadata.php )
* test authentication on the SP via https://localhost/_sp/module.php/admin/test/default-sp (metadata at https://localhost/_sp/module.php/saml/sp/metadata/default-sp )

To wire your wiki application, create a new file <code>settings.d/099-SAML-dev.local.php</code> within your <code>$CODEDIR</code>
<syntaxhighlight lang="php"><?php

$GLOBALS['wgExtensionFunctions'][] = function () {
$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
'plugin' => 'SimpleSAMLphp',
'data' => [
'authSourceId' => 'default-sp',
'usernameAttribute' => 'name',
'realNameAttribute' => 'name',
'emailAttribute' => 'email'
],
'groupsyncs' => [
[
'type' => 'mapped',
'map' => [
'editor' => [
'groups' => 'wiki-contributor'
],
'sysop' => [
'groups' => 'wiki-admin'
]
]
]
]

];
};
</syntaxhighlight>

Development/SAML 2.0 IdP

2026-07-14T11:31:56Z

Rvogel1:

Create the following files and folders within your <code>$DATADIR</code>
<syntaxhighlight lang="text">
└── saml-idp
├── saml-config.php
├── saml-sp-metadata.php
└── saml-users.php

</syntaxhighlight>

Add the following content to the files

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-config.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/config.php

$idPbaseUrl = 'https://' . getenv( 'DEV_SHARED_IDP_HOST' );
$config = [
'baseurlpath' => $idPbaseUrl . '/_samlidp/simplesaml/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
'tempdir' => '/tmp/simplesaml',
'debug' => true,
'showerrors' => true,
'errorreporting' => true,
'debug.validatexml' => false,
'auth.adminpassword' => 'secret',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
'secretsalt' => 'defaultsecretsalt',
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.invalid',
'timezone' => NULL,
'logging.level' => SimpleSAML_Logger::DEBUG,
'logging.handler' => 'errorlog',
'logging.facility' => 168,
'logging.processname' => 'simplesamlphp',
'logging.logfile' => 'simplesamlphp.log',
'statistics.out' => [],
'database.dsn' => 'mysql:host=localhost;dbname=saml',
'database.username' => 'simplesamlphp',
'database.password' => 'secret',
'database.prefix' => '',
'database.persistent' => false,
'database.slaves' => [],
'enable.saml20-idp' => true,
'enable.shib13-idp' => true,
'enable.adfs-idp' => false,
'enable.wsfed-sp' => false,
'enable.authmemcookie' => false,
'session.duration' => 28800,
'session.datastore.timeout' => 14400,
'session.state.timeout' => 3600,
'session.cookie.name' => 'SimpleSAMLSessionIDIdp',
'session.cookie.lifetime' => 0,
'session.cookie.path' => '/',
'session.cookie.domain' => NULL,
'session.cookie.secure' => false,
'enable.http_post' => false,
'session.phpsession.cookiename' => 'PHPSESSIDIDP',
'session.phpsession.savepath' => NULL,
'session.phpsession.httponly' => true,
'session.authtoken.cookiename' => 'SimpleSAMLAuthTokenIdp',
'session.rememberme.enable' => false,
'session.rememberme.checked' => false,
'session.rememberme.lifetime' => 1209600,
'language.available' =>
[
0 => 'en',
1 => 'no',
2 => 'nn',
3 => 'se',
4 => 'da',
5 => 'de',
6 => 'sv',
7 => 'fi',
8 => 'es',
9 => 'fr',
10 => 'it',
11 => 'nl',
12 => 'lb',
13 => 'cs',
14 => 'sl',
15 => 'lt',
16 => 'hr',
17 => 'hu',
18 => 'pl',
19 => 'pt',
20 => 'pt-br',
21 => 'tr',
22 => 'ja',
23 => 'zh',
24 => 'zh-tw',
25 => 'ru',
26 => 'et',
27 => 'he',
28 => 'id',
29 => 'sr',
30 => 'lv',
31 => 'ro',
32 => 'eu',
],
'language.rtl' =>
[
0 => 'ar',
1 => 'dv',
2 => 'fa',
3 => 'ur',
4 => 'he',
],
'language.default' => 'en',
'language.parameter.name' => 'language',
'language.parameter.setcookie' => true,
'language.cookie.name' => 'language',
'language.cookie.domain' => NULL,
'language.cookie.path' => '/',
'language.cookie.lifetime' => 77760000,
'attributes.extradictionary' => NULL,
'theme.use' => 'default',
'default-wsfed-idp' => 'urn:federation:pingfederate:localhost',
'idpdisco.enableremember' => true,
'idpdisco.rememberchecked' => true,
'idpdisco.validate' => true,
'idpdisco.extDiscoveryStorage' => NULL,
'idpdisco.layout' => 'dropdown',
'shib13.signresponse' => true,
'authproc.idp' =>
[
30 => 'core:LanguageAdaptor',
45 =>
[
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
],
50 => 'core:AttributeLimit',
99 => 'core:LanguageAdaptor',
],
'authproc.sp' =>
[
90 => 'core:LanguageAdaptor',
],
'metadata.sources' =>
[
[
'type' => 'flatfile',
],
],
'store.type' => 'phpsession',
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
'store.sql.username' => NULL,
'store.sql.password' => NULL,
'store.sql.prefix' => 'SimpleSAMLphp',
'memcache_store.servers' =>
[
[
[
'hostname' => 'localhost',
],
],
],
'memcache_store.prefix' => NULL,
'memcache_store.expires' => 129600,
'metadata.sign.enable' => false,
'metadata.sign.privatekey' => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
'proxy' => NULL,
'trusted.url.domains' => [],
];
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-sp-metadata.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-users.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php

$pass = getenv( 'DB_ROOT_PASS' );

$config = [
'admin' => [
'core:AdminPassword',
],
'example-userpass' => [
// First element must be a string which identifies the authentication source.
'exampleauth:UserPass',

"alice@example.invalid:$pass" => [
'username' => [ 'alice@example.invalid' ],
'name' => [ 'Alice' ],
'email' => [ 'alice@example.invalid' ],
'groups' => [ 'wiki-contributor', 'wiki-admin' ]
],
"bob@example.invalid:$pass" => [
'username' => [ 'bob@example.invalid' ],
'name' => [ 'Bob' ],
'email' => [ 'bob@example.invalid' ],
'groups' => [ 'wiki-contributor' ]
],
"charlie@example.invalid:$pass" => [
'username' => [ 'charlie@example.invalid' ],
'name' => [ 'Charlie' ],
'email' => [ 'charlie@example.invalid' ],
'groups' => [ 'wiki-admin' ]
]
],
];
</syntaxhighlight></div>
</div>

In your <code>docker-compose.override.yml</code> add<syntaxhighlight lang="yaml">
samlidp:
image: kristophjunge/test-saml-idp
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
volumes:
- ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
- ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
- ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_samlidp/
VIRTUAL_PORT: 8080
VIRTUAL_DEST: /
DEV_SHARED_IDP_HOST: ${WIKI_HOST}
DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
restart: no
</syntaxhighlight>
After starting the stack with <code>./bluespice-deploy up -d</code> you can
* access the IdP via https://localhost/_samlidp/simplesaml/module.php/core/frontpage_welcome.php (metadata at https://localhost/_samlidp/simplesaml/saml2/idp/metadata.php )
* test authentication on the SP via https://localhost/_sp/module.php/admin/test/default-sp (metadata at https://localhost/_sp/module.php/saml/sp/metadata/default-sp )

To wire your wiki application, create a new file <code>settings.d/099-SAML-dev.local.php</code> within your <code>$CODEDIR</code>
<syntaxhighlight lang="php"><?php

$GLOBALS['wgExtensionFunctions'][] = function () {
$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
'plugin' => 'SimpleSAMLphp',
'data' => [
'authSourceId' => 'default-sp',
'usernameAttribute' => 'username',
'realNameAttribute' => 'name',
'emailAttribute' => 'email'
],
'groupsyncs' => [
[
'type' => 'mapped',
'map' => [
'editor' => [
'groups' => 'wiki-contributor'
],
'sysop' => [
'groups' => 'wiki-admin'
]
]
]
]

];
};
</syntaxhighlight>

Development/SAML 2.0 IdP

2026-07-14T11:25:38Z

Rvogel1:

Create the following files and folders within your <code>$DATADIR</code>
<syntaxhighlight lang="text">
└── saml-idp
├── saml-config.php
├── saml-sp-metadata.php
└── saml-users.php

</syntaxhighlight>

Add the following content to the files

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-config.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/config.php

$idPbaseUrl = 'https://' . getenv( 'DEV_SHARED_IDP_HOST' );
$config = [
'baseurlpath' => $idPbaseUrl . '/_samlidp/simplesaml/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
'tempdir' => '/tmp/simplesaml',
'debug' => true,
'showerrors' => true,
'errorreporting' => true,
'debug.validatexml' => false,
'auth.adminpassword' => 'secret',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
'secretsalt' => 'defaultsecretsalt',
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.invalid',
'timezone' => NULL,
'logging.level' => SimpleSAML_Logger::DEBUG,
'logging.handler' => 'errorlog',
'logging.facility' => 168,
'logging.processname' => 'simplesamlphp',
'logging.logfile' => 'simplesamlphp.log',
'statistics.out' => [],
'database.dsn' => 'mysql:host=localhost;dbname=saml',
'database.username' => 'simplesamlphp',
'database.password' => 'secret',
'database.prefix' => '',
'database.persistent' => false,
'database.slaves' => [],
'enable.saml20-idp' => true,
'enable.shib13-idp' => true,
'enable.adfs-idp' => false,
'enable.wsfed-sp' => false,
'enable.authmemcookie' => false,
'session.duration' => 28800,
'session.datastore.timeout' => 14400,
'session.state.timeout' => 3600,
'session.cookie.name' => 'SimpleSAMLSessionIDIdp',
'session.cookie.lifetime' => 0,
'session.cookie.path' => '/',
'session.cookie.domain' => NULL,
'session.cookie.secure' => false,
'enable.http_post' => false,
'session.phpsession.cookiename' => 'PHPSESSIDIDP',
'session.phpsession.savepath' => NULL,
'session.phpsession.httponly' => true,
'session.authtoken.cookiename' => 'SimpleSAMLAuthTokenIdp',
'session.rememberme.enable' => false,
'session.rememberme.checked' => false,
'session.rememberme.lifetime' => 1209600,
'language.available' =>
[
0 => 'en',
1 => 'no',
2 => 'nn',
3 => 'se',
4 => 'da',
5 => 'de',
6 => 'sv',
7 => 'fi',
8 => 'es',
9 => 'fr',
10 => 'it',
11 => 'nl',
12 => 'lb',
13 => 'cs',
14 => 'sl',
15 => 'lt',
16 => 'hr',
17 => 'hu',
18 => 'pl',
19 => 'pt',
20 => 'pt-br',
21 => 'tr',
22 => 'ja',
23 => 'zh',
24 => 'zh-tw',
25 => 'ru',
26 => 'et',
27 => 'he',
28 => 'id',
29 => 'sr',
30 => 'lv',
31 => 'ro',
32 => 'eu',
],
'language.rtl' =>
[
0 => 'ar',
1 => 'dv',
2 => 'fa',
3 => 'ur',
4 => 'he',
],
'language.default' => 'en',
'language.parameter.name' => 'language',
'language.parameter.setcookie' => true,
'language.cookie.name' => 'language',
'language.cookie.domain' => NULL,
'language.cookie.path' => '/',
'language.cookie.lifetime' => 77760000,
'attributes.extradictionary' => NULL,
'theme.use' => 'default',
'default-wsfed-idp' => 'urn:federation:pingfederate:localhost',
'idpdisco.enableremember' => true,
'idpdisco.rememberchecked' => true,
'idpdisco.validate' => true,
'idpdisco.extDiscoveryStorage' => NULL,
'idpdisco.layout' => 'dropdown',
'shib13.signresponse' => true,
'authproc.idp' =>
[
30 => 'core:LanguageAdaptor',
45 =>
[
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
],
50 => 'core:AttributeLimit',
99 => 'core:LanguageAdaptor',
],
'authproc.sp' =>
[
90 => 'core:LanguageAdaptor',
],
'metadata.sources' =>
[
[
'type' => 'flatfile',
],
],
'store.type' => 'phpsession',
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
'store.sql.username' => NULL,
'store.sql.password' => NULL,
'store.sql.prefix' => 'SimpleSAMLphp',
'memcache_store.servers' =>
[
[
[
'hostname' => 'localhost',
],
],
],
'memcache_store.prefix' => NULL,
'memcache_store.expires' => 129600,
'metadata.sign.enable' => false,
'metadata.sign.privatekey' => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
'proxy' => NULL,
'trusted.url.domains' => [],
];
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-sp-metadata.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-users.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php

$pass = getenv( 'DB_ROOT_PASS' );

$config = [
'admin' => [
'core:AdminPassword',
],
'example-userpass' => [
// First element must be a string which identifies the authentication source.
'exampleauth:UserPass',

"alice@example.invalid:$pass" => [
'username' => [ 'alice@example.invalid' ],
'name' => [ 'Alice' ],
'email' => [ 'alice@example.invalid' ],
'groups' => [ 'wiki-contributor', 'wiki-admin' ]
],
"bob@example.invalid:$pass" => [
'username' => [ 'bob@example.invalid' ],
'name' => [ 'Bob' ],
'email' => [ 'bob@example.invalid' ],
'groups' => [ 'wiki-contributor' ]
],
"charlie@example.invalid:$pass" => [
'username' => [ 'charlie@example.invalid' ],
'name' => [ 'Charlie' ],
'email' => [ 'charlie@example.invalid' ],
'groups' => [ 'wiki-admin' ]
]
],
];
</syntaxhighlight></div>
</div>

In your <code>docker-compose.override.yml</code> add<syntaxhighlight lang="yaml">
samlidp:
image: kristophjunge/test-saml-idp
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
volumes:
- ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
- ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
- ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_samlidp/
VIRTUAL_PORT: 8080
VIRTUAL_DEST: /
DEV_SHARED_IDP_HOST: ${WIKI_HOST}
DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
restart: no
</syntaxhighlight>
After

Within your <code>$CODEDIR</code>, create a new file

<div class="toccolours mw-collapsible mw-collapsed">
<code>settings.d/099-SAML-dev.local.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

$GLOBALS['wgExtensionFunctions'][] = function () {
$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
'plugin' => 'SimpleSAMLphp',
'data' => [
'authSourceId' => 'default-sp',
'usernameAttribute' => 'username',
'realNameAttribute' => 'name',
'emailAttribute' => 'email'
],
'groupsyncs' => [
[
'type' => 'mapped',
'map' => [
'editor' => [
'groups' => 'wiki-contributor'
],
'sysop' => [
'groups' => 'wiki-admin'
]
]
]
]

];
};
</syntaxhighlight></div>
</div>

Development/SAML 2.0 IdP

2026-07-14T11:24:36Z

Rvogel1:

Development/SAML 2.0 IdP

2026-07-14T11:22:35Z

Rvogel1: Created page with "Create the following files and folders within your <code>$DATADIR</code> <syntaxhighlight lang="text"> └── saml-idp ├── saml-config.php ├── saml-sp-metadata.php └── saml-users.php </syntaxhighlight> Add the following content to the files <div class="toccolours mw-collapsible mw-collapsed"> <code>saml-sp-metadata.php</code> <div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php #SIMPLESAMLPHP_SP_ENTITY_ID: https://${D..."

Development

2026-07-14T11:09:24Z

Rvogel1:

Development/S3 filestore service

2026-07-14T11:08:39Z

Rvogel1: Created page with "When working on the S3 filestore features, a developer needs a local S3 service. One can add the following to <code>docker-compose.override.yml</code><syntaxhighlight lang="yaml"> x-common-dev: &x-common ... environment: FILESTORE_HOST: filestore FILESTORE_PORT: 9000 FILESTORE_PROTOCOL: http FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY} FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY} FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice} F..."

When working on the S3 filestore features, a developer needs a local S3 service. One can add the following to <code>docker-compose.override.yml</code><syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code>, add<syntaxhighlight lang="text">FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1</syntaxhighlight>After a <code>./bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

You will need to ''manually create'' a bucket with the name of <code>FILESTORE_BUCKET_NAME</code>.

Development

2026-07-14T11:08:29Z

Rvogel1:

Development

2026-07-10T06:17:57Z

Rvogel1: /* Add S3 filestore service */

{{Textbox|boxtype=warning|header=Do not apply to production environments!|text=This page contains information about how to set up a '''local development environment''' for BlueSpice. None of this is supposed to be used on an production system!|icon=yes}}

== Local development environment based on <code>bluespice-deploy</code> ==
A developer can use the [[Setup:Installation Guide/Docker|default deployment stack]] and alter is to quickly set up a development environment. To do so, first clone the stack to your local machine and navigate into it:
<syntaxhighlight lang="text">
git clone -b 5.2.x git@github.com:hallowelt/bluespice-deploy.git
cd bluespice-deploy/compose
</syntaxhighlight>

Create a proper <code>.env</code> file from the <code>.env.sample</code> and alter/add the following lines:
<syntaxhighlight lang="text">
DATADIR=~/workspace/REL1_43-5.2.x/data
CODEDIR=~/workspace/REL1_43-5.2.x/code
SMTP_HOST=mailhog
SMTP_PORT=1025
</syntaxhighlight>

Create a <code>docker-compose.override.yml</code> file with the following content:
<syntaxhighlight lang="yaml">
x-common-dev: &x-common
image: docker.bluespice.com/bluespice-qa/wiki:latest
volumes:
- ${CODEDIR}:/app/bluespice/w/

services:

wiki-installer:
<<: *x-common

wiki-web:
<<: *x-common
restart: no

wiki-task:
<<: *x-common
restart: no

mailhog:
image: mailhog/mailhog
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-mailhog
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_mailhog/
VIRTUAL_PORT: 8025
VIRTUAL_DEST: /
restart: no

cache:
restart: no

collabpads:
restart: no

collabpads-database:
restart: no

database:
restart: no

diagram:
restart: no

formula:
restart: no

pdf:
restart: no

proxy:
restart: no

search:
restart: no

wire:
restart: no
</syntaxhighlight>

This will make the stack use your local codebase from <code>$CODEDIR</code> and also expose a Mailhog web interface on <code>$Wiki_HOST/_mailhog</code>.

In addition, if you want to work with a custom build of the <code>bluespice/wiki</code> container, you can add an <code>image:</code> entry to the respective services. Example
<syntaxhighlight lang="yaml">
wiki-installer:
image: bluespice/wiki:dev
...
wiki-web:
image: bluespice/wiki:dev
...

wiki-task:
image: bluespice/wiki:dev
...
</syntaxhighlight>or you set<blockquote>BLUESPICE_WIKI_IMAGE=bluespice/wiki:dev</blockquote>in your <code>.env</code>-File

=== Add S3 <code>filestore</code> service ===
When working on the S3 filestore features, a developer needs a local S3 service. One can add the following to <code>docker-compose.override.yml</code> <syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code>, add <syntaxhighlight lang="text">FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1</syntaxhighlight>After a <code>./bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

You will need to ''manually create'' a bucket with the name of <code>FILESTORE_BUCKET_NAME</code>.

== Local development environment based on <code>bluespice-containers</code> ==
As an alternative, one can use https://github.com/BlueSpice-Wiki/bluespice-containers . This is especially useful when working on the various individual services.

Development

2026-07-10T06:16:54Z

Rvogel1: /* Add S3 filestore service */

{{Textbox|boxtype=warning|header=Do not apply to production environments!|text=This page contains information about how to set up a '''local development environment''' for BlueSpice. None of this is supposed to be used on an production system!|icon=yes}}

== Local development environment based on <code>bluespice-deploy</code> ==
A developer can use the [[Setup:Installation Guide/Docker|default deployment stack]] and alter is to quickly set up a development environment. To do so, first clone the stack to your local machine and navigate into it:
<syntaxhighlight lang="text">
git clone -b 5.2.x git@github.com:hallowelt/bluespice-deploy.git
cd bluespice-deploy/compose
</syntaxhighlight>

Create a proper <code>.env</code> file from the <code>.env.sample</code> and alter/add the following lines:
<syntaxhighlight lang="text">
DATADIR=~/workspace/REL1_43-5.2.x/data
CODEDIR=~/workspace/REL1_43-5.2.x/code
SMTP_HOST=mailhog
SMTP_PORT=1025
</syntaxhighlight>

Create a <code>docker-compose.override.yml</code> file with the following content:
<syntaxhighlight lang="yaml">
x-common-dev: &x-common
image: docker.bluespice.com/bluespice-qa/wiki:latest
volumes:
- ${CODEDIR}:/app/bluespice/w/

services:

wiki-installer:
<<: *x-common

wiki-web:
<<: *x-common
restart: no

wiki-task:
<<: *x-common
restart: no

mailhog:
image: mailhog/mailhog
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-mailhog
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_mailhog/
VIRTUAL_PORT: 8025
VIRTUAL_DEST: /
restart: no

cache:
restart: no

collabpads:
restart: no

collabpads-database:
restart: no

database:
restart: no

diagram:
restart: no

formula:
restart: no

pdf:
restart: no

proxy:
restart: no

search:
restart: no

wire:
restart: no
</syntaxhighlight>

This will make the stack use your local codebase from <code>$CODEDIR</code> and also expose a Mailhog web interface on <code>$Wiki_HOST/_mailhog</code>.

In addition, if you want to work with a custom build of the <code>bluespice/wiki</code> container, you can add an <code>image:</code> entry to the respective services. Example
<syntaxhighlight lang="yaml">
wiki-installer:
image: bluespice/wiki:dev
...
wiki-web:
image: bluespice/wiki:dev
...

wiki-task:
image: bluespice/wiki:dev
...
</syntaxhighlight>or you set<blockquote>BLUESPICE_WIKI_IMAGE=bluespice/wiki:dev</blockquote>in your <code>.env</code>-File

=== Add S3 <code>filestore</code> service ===
When working on the S3 filestore features, a developer needs a local S3 service. One can add the following to <code>docker-compose.override.yml</code> <syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code>, add <syntaxhighlight lang="text">
FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1
</syntaxhighlight>After a <code>./bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

== Local development environment based on <code>bluespice-containers</code> ==
As an alternative, one can use https://github.com/BlueSpice-Wiki/bluespice-containers . This is especially useful when working on the various individual services.

Development

2026-07-10T06:11:56Z

Rvogel1:

{{Textbox|boxtype=warning|header=Do not apply to production environments!|text=This page contains information about how to set up a '''local development environment''' for BlueSpice. None of this is supposed to be used on an production system!|icon=yes}}

== Local development environment based on <code>bluespice-deploy</code> ==
A developer can use the [[Setup:Installation Guide/Docker|default deployment stack]] and alter is to quickly set up a development environment. To do so, first clone the stack to your local machine and navigate into it:
<syntaxhighlight lang="text">
git clone -b 5.2.x git@github.com:hallowelt/bluespice-deploy.git
cd bluespice-deploy/compose
</syntaxhighlight>

Create a proper <code>.env</code> file from the <code>.env.sample</code> and alter/add the following lines:
<syntaxhighlight lang="text">
DATADIR=~/workspace/REL1_43-5.2.x/data
CODEDIR=~/workspace/REL1_43-5.2.x/code
SMTP_HOST=mailhog
SMTP_PORT=1025
</syntaxhighlight>

Create a <code>docker-compose.override.yml</code> file with the following content:
<syntaxhighlight lang="yaml">
x-common-dev: &x-common
image: docker.bluespice.com/bluespice-qa/wiki:latest
volumes:
- ${CODEDIR}:/app/bluespice/w/

services:

wiki-installer:
<<: *x-common

wiki-web:
<<: *x-common
restart: no

wiki-task:
<<: *x-common
restart: no

mailhog:
image: mailhog/mailhog
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-mailhog
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_mailhog/
VIRTUAL_PORT: 8025
VIRTUAL_DEST: /
restart: no

cache:
restart: no

collabpads:
restart: no

collabpads-database:
restart: no

database:
restart: no

diagram:
restart: no

formula:
restart: no

pdf:
restart: no

proxy:
restart: no

search:
restart: no

wire:
restart: no
</syntaxhighlight>

This will make the stack use your local codebase from <code>$CODEDIR</code> and also expose a Mailhog web interface on <code>$Wiki_HOST/_mailhog</code>.

In addition, if you want to work with a custom build of the <code>bluespice/wiki</code> container, you can add an <code>image:</code> entry to the respective services. Example
<syntaxhighlight lang="yaml">
wiki-installer:
image: bluespice/wiki:dev
...
wiki-web:
image: bluespice/wiki:dev
...

wiki-task:
image: bluespice/wiki:dev
...
</syntaxhighlight>or you set<blockquote>BLUESPICE_WIKI_IMAGE=bluespice/wiki:dev</blockquote>in your <code>.env</code>-File

=== Add S3 <code>filestore</code> service ===
When working on the S3 filestore features, a developer needs a <syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code> <syntaxhighlight lang="text">
FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1
</syntaxhighlight>After a <code>/bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

== Local development environment based on <code>bluespice-containers</code> ==
As an alternative, one can use https://github.com/BlueSpice-Wiki/bluespice-containers . This is especially useful when working on the various individual services.

Development

2026-07-10T06:08:39Z

Rvogel1:

This page contains information about how to set up a local development environment for BlueSpice.

== Local development environment based on <code>bluespice-deploy</code> ==
A developer can use the [[Setup:Installation Guide/Docker|default deployment stack]] and alter is to quickly set up a development environment. To do so, first clone the stack to your local machine and navigate into it:
<syntaxhighlight lang="text">
git clone -b 5.2.x git@github.com:hallowelt/bluespice-deploy.git
cd bluespice-deploy/compose
</syntaxhighlight>

Create a proper <code>.env</code> file from the <code>.env.sample</code> and alter/add the following lines:
<syntaxhighlight lang="text">
DATADIR=~/workspace/REL1_43-5.2.x/data
CODEDIR=~/workspace/REL1_43-5.2.x/code
SMTP_HOST=mailhog
SMTP_PORT=1025
</syntaxhighlight>

Create a <code>docker-compose.override.yml</code> file with the following content:
<syntaxhighlight lang="yaml">
x-common-dev: &x-common
image: docker.bluespice.com/bluespice-qa/wiki:latest
volumes:
- ${CODEDIR}:/app/bluespice/w/

services:

wiki-installer:
<<: *x-common

wiki-web:
<<: *x-common
restart: no

wiki-task:
<<: *x-common
restart: no

mailhog:
image: mailhog/mailhog
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-mailhog
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_mailhog/
VIRTUAL_PORT: 8025
VIRTUAL_DEST: /
restart: no

cache:
restart: no

collabpads:
restart: no

collabpads-database:
restart: no

database:
restart: no

diagram:
restart: no

formula:
restart: no

pdf:
restart: no

proxy:
restart: no

search:
restart: no

wire:
restart: no
</syntaxhighlight>

This will make the stack use your local codebase from <code>$CODEDIR</code> and also expose a Mailhog web interface on <code>$Wiki_HOST/_mailhog</code>.

In addition, if you want to work with a custom build of the <code>bluespice/wiki</code> container, you can add an <code>image:</code> entry to the respective services. Example
<syntaxhighlight lang="yaml">
wiki-installer:
image: bluespice/wiki:dev
...
wiki-web:
image: bluespice/wiki:dev
...

wiki-task:
image: bluespice/wiki:dev
...
</syntaxhighlight>or you set<blockquote>BLUESPICE_WIKI_IMAGE=bluespice/wiki:dev</blockquote>in your <code>.env</code>-File

=== Add S3 <code>filestore</code> service ===
When working on the S3 filestore features, a developer needs a <syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code> <syntaxhighlight lang="text">
FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1
</syntaxhighlight>After a <code>/bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

Security:Security Advisories

2026-06-22T08:41:06Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
|[[Security:Security Advisories/BSSA-2026-04|BSSA-2026-04]]
|2026-06-22
|Security vulnerabilities in Confluence Migration Tool container image
|[https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|Heap buffer overflow vulnerability in Perl Regexes
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-04

2026-06-22T08:38:42Z

Security:Security Advisories

2026-06-08T09:06:59Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-03

2026-06-08T09:02:50Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-06-08
|-
|Severity
|reported "medium/high", BlueSpice assessment: '''not affected'''
|-
|Affected
|Cloudogu Container Images (library present, not exploitable)
|-
|Fixed in
|Next regular update
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-31789
|<code>hallowelt/bluespice-mathoid</code>, <code>hallowelt/bluespice-collabpadsbackend</code>, <code>hallowelt/mongodb</code>
|Heap Buffer Overflow (OpenSSL, 32-bit only)
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-43512
|<code>hallowelt/bluespice-pdfrenderer</code>, <code>hallowelt/drawio</code>
|Authentication Bypass (Apache Tomcat DIGEST)
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-7261
|<code>hallowelt/bluespice</code>
|PHP SOAP Server Session Persistence
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-31789
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. The vulnerability only applies to 32-bit platforms. Additionally, the way OpenSSL is used in the affected container images does not expose any exploitable attack surface.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-43512
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. Neither <code>bluespice-pdfrenderer</code> nor <code>drawio</code> use DIGEST authentication. Access to both services is anonymous by design.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-7261
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. BlueSpice does not use a PHP SOAP server, and the affected <code>SOAP_PERSISTENCE_SESSION</code> setting is not in use.
| style="vertical-align:middle;text-align:left;" |No action required.
|}

== Solution ==
No immediate action required. The affected libraries will be updated in the next regular release.