PHP: Critical remote code execution vulnerabilities - Which Versions are safe?

Configuration/Setup
1

Due to PHP: News Archive - 2026 we took our Bluespice Wiki down this Morning.

Due to the specific setup of Mediawiki/Bluespice, will we need to update it and what version will have it fixed?

Exploits against MediaWiki are already visible:

https://x.com/k_firsov/status/2112641845926989944

2

We are about to release a nano version (5.2.7.1 and 5.1.11.1) of the affected containers. We currently wait for upstream maintainers to provide patched OS packages. In the meantime, please take the application offline. See also PHP Security issue: early warning · Advisory · BlueSpice-Wiki/bluespice-free-release · GitHub

3

Updated images for 5.2.7.1 and 5.1.11.1 are available.

Those images are also tagged with 5, 5.2 and 5.1

Be aware that we did not tag the companion services

Check your .env file: VERSION has to be 5.2 or 5.1. You can not set it to 5.2.7.1 or 5.1.11.1 because the companion services do not share this version.

4

Is the file bluespice_wiki_5.2.7.tar-1.gz that you can download from Download | BlueSpice MediaWiki BlueSpice pro 5.2.7.1? Sha256 is a204dce341e1b0f852f44f859f2f1cad34c47b0beba671fa83a37174b13dd431

The image tag is bluespice/wiki:5.2.7 and the included /app/bluespice/w/BLUESPICE-VERSION is 5.2.7 so I suspect it is still 5.2.7

5

You are right. Until just now there wasn’t a version on bluespice.com. Now you can find tarballs for 5.1.11.1 and 5.2.7.1 that include the fix. Please be aware that you may need to update the collabpads service too, which is only available from hub.docker.com.

6

Download | BlueSpice - now contains the 5.2.7.1.tar.gz for Pro|Farm. The download only contains the updated image (assume expected), however there isn’t a link to historical (i.e. 5.2.7 released 2026/10/19) packages.

Updating VERSION to 5.2.7 in .env won’t work because I haven’t loaded the 5.2.7 base version, is my overall assumption. Is there a link I’m over looking?

7

Yes, that’s right.

Check your .env file: VERSION has to be 5.2 or 5.1. You can not set it to 5.2.7.1 or 5.1.11.1 because the companion services do not share this version.

Alternatively, you can just re-tag the 5.2.7.1 image locally just the way you want.

8

If you pulled the updated 5.2 or 5.1 images, it is worth confirming that the container is really running the patched build rather than just trusting the tag. You can run docker compose pull followed by docker compose up -d, then check which image ID the wiki container uses with docker compose images, and compare that against what you pulled. Since the companion services are not tagged with the nano version, keep VERSION in your .env at 5.2 or 5.1 as mentioned above and pull all services together so they stay in sync. It also helps to take a database dump and a copy of your data volume before the upgrade, so you can roll back quickly if something misbehaves. Until you have verified the patched image, keeping the wiki behind a VPN or an IP allow list is a sensible stopgap.

9

Please be aware that in the meantime another release was made. Please update to 5.1.11.2or 5.2.7.2. See also the official security advisory.

10

Thanks for the update!