- Compatible XF Versions
- 2.1
Today, we are releasing XenForo 2.1.11 to address a potential security vulnerability. We recommend that all customers running XenForo 2.1 upgrade to 2.1.11 or use the attached patch file as soon as possible. (For customers running XenForo 2.0, we can only recommend upgrading to the latest version.)
The issue is a cross site request forgery (CSRF) on the login form. This may allow an attacker to unexpectedly log users into an attacker-controlled account. In some scenarios, this may cause privacy concerns if users take certain actions while logged into the incorrect account. Note that this does not give an attacker any access to the user's true account.
We recommend doing a full upgrade to resolve this issue, but a patch can be applied manually. See below for further details.
Download XenForo 2.1.11
or
Upgrade directly from within your control panel
Current Requirements
Please note that XenForo 2.1.x has higher system requirements than XenForo 1.x.
The following are minimum requirements:
Full details of how to install and upgrade XenForo can be found in the XenForo 2 Manual.
If you are already running XF 2.1 or above we strongly recommend upgrading directly from within your control panel.
Note that when upgrading from XenForo 1.x, all add-ons will be disabled and style customizations will not be maintained. New versions of add-ons will need to be installed and customizations will need to be redone. We strongly recommended that you make a backup before attempting an upgrade. Once upgraded, you will not be able to downgrade without restoring from a backup.
The issue is a cross site request forgery (CSRF) on the login form. This may allow an attacker to unexpectedly log users into an attacker-controlled account. In some scenarios, this may cause privacy concerns if users take certain actions while logged into the incorrect account. Note that this does not give an attacker any access to the user's true account.
We recommend doing a full upgrade to resolve this issue, but a patch can be applied manually. See below for further details.
Download XenForo 2.1.11
or
Upgrade directly from within your control panel
Current Requirements
Please note that XenForo 2.1.x has higher system requirements than XenForo 1.x.
The following are minimum requirements:
- PHP 5.6 or newer (PHP 7.4 recommended)
- MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
- All of the official add-ons require XenForo 2.1.
- Enhanced Search requires at least Elasticsearch 2.0.
Full details of how to install and upgrade XenForo can be found in the XenForo 2 Manual.
If you are already running XF 2.1 or above we strongly recommend upgrading directly from within your control panel.
Note that when upgrading from XenForo 1.x, all add-ons will be disabled and style customizations will not be maintained. New versions of add-ons will need to be installed and customizations will need to be redone. We strongly recommended that you make a backup before attempting an upgrade. Once upgraded, you will not be able to downgrade without restoring from a backup.
