Security

2026-06-08

SecurityNews

Security Advisory

Blesta 5.13.9 patches one low-severity security issue with defense-in-depth hardening, plus fixes for partial refunds, OAuth2 callbacks, and email blacklists.

Paul2 min read

2026-05-18

SecurityNews

Security Advisory

High-impact security advisory for Blesta 3.0.0 through 5.13.7 covering authorization, API code execution, email parsing, and CSRF fixes. Upgrade to 5.13.8 or patch.

Paul4 min read

2026-01-28

SecurityNews

Security Advisory

Critical security advisory for Blesta 3.0.0 through 5.13.1: input validation and object injection flaws with possible remote code execution. Upgrade to 5.13.3 or patch.

Paul3 min read

2025-06-09

SecurityNews

Security Advisory

Security advisory: a High-impact path traversal vulnerability affects Blesta 4.0.0 through 5.11.3. Upgrade to 5.11.4 or apply the 5.11.4 or 5.10.4 patch.

Paul2 min read

2024-02-08

SecurityNews

Security Advisory

Critical security advisory for Blesta 5.0.0 through 5.9.1: a path traversal flaw can chain to account compromise and RCE. Patch or upgrade to 5.9.2 now.

Paul3 min read

2020-06-10

SecurityNews

Security Advisory - Blesta 4.10.1 Patch Released

Blesta 4.10.1 security advisory fixes a Moderate XSS flaw in the Order Manager plus one other 4.10.0 bug. Mitigation files are provided for 4.6 through 4.9.

Paul2 min read

2016-08-02

Security

Security Advisory

Blesta security advisory rated Low affects versions 3.0.0 through 3.6.1, addressing full path disclosure. Upgrade or patch to 3.6.2 to resolve it.

Paul2 min read

2014-05-14

Security

Security Advisory – Two-Factor and Privilege Issues

Security advisory for Blesta 3.0.0 through 3.1.3: a Low TOTP two-factor guessing flaw and a Moderate staff ACL privilege issue. Upgrade to 3.1.4 or 3.2.0.

Cody1 min read