IPFire has launched Core Update 206 for public testing, primarily addressing two command-injection vulnerabilities in its "Who Is Online" (WIO) add-on, which could allow attackers to execute shell commands with the web server's privileges. The update also includes a complete rebuild of the web UI to eliminate the need for spawning a shell, thus preventing a range of potential injection flaws, while also enhancing the localization system by implementing GNU gettext and a dedicated Weblate instance for translations. Additionally, CU206 refreshes various components of the operating system, including major updates to OpenSSL, Suricata, and other packages, and introduces LoongArch as a new supported architecture. IPFire encourages WIO users to install the update promptly for security while continuing to test the new features in a safe environment

IPFire 2.29 Core Update 206 Opens to Testing with WIO Command-Injection Fixes

IPFire has opened Core Update 206 to public testing, with the main urgency being a pair of command-injection vulnerabilities in its "Who Is Online" (WIO) add-on that let attackers run shell commands with the web server's privileges. The project also rebuilt its web UI to no longer spawn a shell at all, closing an entire class of injection flaws, and removed compromised root certificates and hardened the DNS resolver and IPS along the way. Beyond security, CU206 reworks IPFire's localization around GNU gettext and a dedicated Weblate instance, adds LoongArch as its fourth 64-bit architecture, and refreshes a wide slice of the base OS including OpenSSL 3.6.5 and Suricata 8.0.8.

IPFire 2.29 Core Update 206 Opens to Testing with WIO Command-Injection Fixes @ Linux Compatible