Today, we are releasing XenForo 2.2.11 to address a potential security vulnerability. We recommend that all customers running XenForo 2.2 upgrade to 2.2.11 or use the attached patch file as soon as possible.
The issue relates to HTML attribute injection which can be triggered when rendering editor content, such as when a post is edited or quoted.
XenForo extends thanks to security researcher @PAULB, the team at @NamePros and @Xon for reporting the issues.
We recommend doing a full upgrade to resolve the issues, but a patch can be applied manually. See below for further details.
Note: There are no other changes in this release and any work previously done towards XenForo 2.2.11 - including a new CAPTCHA option by Cloudflare Turnstile and various bug fixes and improvements - will be released alongside XenForo 2.2.12 in the coming weeks.
Applying a patch manually
Download the 2211patch.zip file attached to this message. It will contain the following file:- src/XF/BbCode/Renderer/EditorHtml.php
Note: If you decide to patch the files instead of doing a full upgrade, your "File health check" will report this file as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.