From dc8891974072a77c9c2993414fe32759a4c49bdf Mon Sep 17 00:00:00 2001 From: Giacomo Sanchietti Date: Wed, 21 Oct 2026 17:52:07 +0200 Subject: [PATCH 1/3] fix: limit PHP POST size for Nextcloud pool Set post_max_size to 32M and upload_max_filesize to 30M in the Nextcloud php-fpm pool, as mitigation for CVE-2026-109618 and CVE-2026-109619. The values are php_admin_value, so .user.ini cannot raise them. Normal file uploads use WebDAV PUT and are not affected. Document the limits and how to change them in README. NethServer/dev#8256 Assisted-by: Claude Code:claude-sonnet-5-5 --- README.rst | 39 +++++++++++++++++++ .../remi/php80/php-fpm.d/000-nextcloud.conf | 4 ++ 2 files changed, 43 insertions(+) diff --git a/README.rst b/README.rst index b98a6ab..9cc4c7d 100644 --- a/README.rst +++ b/README.rst @@ -80,6 +80,45 @@ Log of php80-fpm The log of php80-fpm can be found at `/opt/remi/php80/log/php-fpm/error-nextcloud.log` +PHP upload limits +================= + +To mitigate the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 +(see the `PHP advisory `_), +the php-fpm pool ``/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf`` keeps the +size of a POST request body low: :: + + php_admin_value[post_max_size] = 32M + php_admin_value[upload_max_filesize] = 30M + +These limits apply only to form uploads (``multipart/form-data`` POST requests), +like the user avatar, the theming logo and some app imports. +Normal file uploads are not affected: the web interface, the desktop and mobile clients +and the public upload shares send files with WebDAV ``PUT`` requests, which are not +limited by these values. + +The values are set with ``php_admin_value``, so the ``/usr/share/nextcloud/.user.ini`` +file cannot raise them. + +If needed, the limits can be raised by hand. Keep the values at 32M or lower: +higher values weaken the mitigation. + +1. Edit ``/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf`` and change the + ``post_max_size`` and ``upload_max_filesize`` lines; ``upload_max_filesize`` must + be lower than ``post_max_size`` +2. Restart php-fpm: ``systemctl restart php80-php-fpm`` + +The file is marked as ``%config(noreplace)``, so manual changes survive package updates. + +If the file was already edited before the update that introduced these limits, +the update leaves it untouched and saves the new version as +``/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf.rpmnew``. +In this case, add the ``post_max_size`` and ``upload_max_filesize`` lines +to ``000-nextcloud.conf`` by hand, then restart php-fpm: :: + + diff /etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf /etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf.rpmnew + systemctl restart php80-php-fpm + Cockpit API =========== diff --git a/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf b/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf index c5de1f7..c8b7cdd 100644 --- a/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf +++ b/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf @@ -37,3 +37,7 @@ php_value[opcache.revalidate_freq] = 1 ; PHP settings php_admin_value[memory_limit] = 512M +; Keep POST bodies small: mitigation for CVE-2026-109618 / CVE-2026-109619. +; File uploads use WebDAV PUT and are not limited by these values. +php_admin_value[post_max_size] = 32M +php_admin_value[upload_max_filesize] = 30M From e6012f77996e677bbdaf893045fadd91237e2c62 Mon Sep 17 00:00:00 2001 From: Giacomo Sanchietti Date: Thu, 22 Oct 2026 08:44:30 +0200 Subject: [PATCH 2/3] fix: keep default upload limits, document cap Nextcloud already runs with the PHP defaults post_max_size = 8M and upload_max_filesize = 2M, which satisfy the PHP mitigation for CVE-2026-109618 and CVE-2026-109619: the packaged .user.ini sets no upload limits. Restore the original pool file and only document in the README that post_max_size must not be raised over 32M. Refs NethServer/dev#8256 Assisted-by: Claude Code:claude-opus-5-5 --- README.rst | 43 ++++--------------- .../remi/php80/php-fpm.d/000-nextcloud.conf | 4 -- 2 files changed, 8 insertions(+), 39 deletions(-) diff --git a/README.rst b/README.rst index 9cc4c7d..1f18c91 100644 --- a/README.rst +++ b/README.rst @@ -83,41 +83,14 @@ The log of php80-fpm can be found at `/opt/remi/php80/log/php-fpm/error-nextclou PHP upload limits ================= -To mitigate the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 -(see the `PHP advisory `_), -the php-fpm pool ``/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf`` keeps the -size of a POST request body low: :: - - php_admin_value[post_max_size] = 32M - php_admin_value[upload_max_filesize] = 30M - -These limits apply only to form uploads (``multipart/form-data`` POST requests), -like the user avatar, the theming logo and some app imports. -Normal file uploads are not affected: the web interface, the desktop and mobile clients -and the public upload shares send files with WebDAV ``PUT`` requests, which are not -limited by these values. - -The values are set with ``php_admin_value``, so the ``/usr/share/nextcloud/.user.ini`` -file cannot raise them. - -If needed, the limits can be raised by hand. Keep the values at 32M or lower: -higher values weaken the mitigation. - -1. Edit ``/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf`` and change the - ``post_max_size`` and ``upload_max_filesize`` lines; ``upload_max_filesize`` must - be lower than ``post_max_size`` -2. Restart php-fpm: ``systemctl restart php80-php-fpm`` - -The file is marked as ``%config(noreplace)``, so manual changes survive package updates. - -If the file was already edited before the update that introduced these limits, -the update leaves it untouched and saves the new version as -``/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf.rpmnew``. -In this case, add the ``post_max_size`` and ``upload_max_filesize`` lines -to ``000-nextcloud.conf`` by hand, then restart php-fpm: :: - - diff /etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf /etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf.rpmnew - systemctl restart php80-php-fpm +Nextcloud runs with the PHP defaults ``post_max_size = 8M`` and +``upload_max_filesize = 2M``. They apply only to form uploads, like the user +avatar and the theming logo: normal file uploads use WebDAV ``PUT`` requests and +are not limited by them. + +Do not raise ``post_max_size`` over 32M: larger values weaken the mitigation for +the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 +(see the `PHP advisory `_). Cockpit API =========== diff --git a/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf b/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf index c8b7cdd..c5de1f7 100644 --- a/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf +++ b/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf @@ -37,7 +37,3 @@ php_value[opcache.revalidate_freq] = 1 ; PHP settings php_admin_value[memory_limit] = 512M -; Keep POST bodies small: mitigation for CVE-2026-109618 / CVE-2026-109619. -; File uploads use WebDAV PUT and are not limited by these values. -php_admin_value[post_max_size] = 32M -php_admin_value[upload_max_filesize] = 30M From 2ef753a5249caa19c565131bd9205d861af7288e Mon Sep 17 00:00:00 2001 From: Giacomo Sanchietti Date: Thu, 22 Oct 2026 09:03:08 +0200 Subject: [PATCH 3/3] fix: limit PHP-FPM workers to one request GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) describes an RCE chain where state left by one request is consumed by the next request handled by the same PHP-FPM worker. Set pm.max_requests = 1 so every worker serves one request and is then replaced. The cost of spawning a worker per request is accepted: opcache shared memory lives in the FPM master and survives worker recycling. Refs NethServer/dev#8256 Assisted-by: Claude Code:claude-sonnet-5-5 --- README.rst | 10 ++++++++++ root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf | 2 ++ 2 files changed, 12 insertions(+) diff --git a/README.rst b/README.rst index 1f18c91..f278a66 100644 --- a/README.rst +++ b/README.rst @@ -92,6 +92,16 @@ Do not raise ``post_max_size`` over 32M: larger values weaken the mitigation for the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (see the `PHP advisory `_). +PHP-FPM workers +=============== + +The Nextcloud pool sets ``pm.max_requests = 1``: each PHP-FPM worker serves +one request and is then replaced, so no state is left for the next request +(mitigation for CVE-2026-109619). The pool file +``/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf`` is ``%config(noreplace)``: +if it was edited locally, the update writes the new version to +``000-nextcloud.conf.rpmnew`` and the setting must be added by hand. + Cockpit API =========== diff --git a/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf b/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf index c5de1f7..0c7c57c 100644 --- a/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf +++ b/root/etc/opt/remi/php80/php-fpm.d/000-nextcloud.conf @@ -14,6 +14,8 @@ pm.max_children = 50 pm.start_servers = 5 pm.min_spare_servers = 5 pm.max_spare_servers = 35 +; Mitigation for CVE-2026-109619: one request per worker - NethServer/dev#8256 +pm.max_requests = 1 user = apache; group = apache