Critical PHP CVE released and patched today. When will Zabbix docker catch up?

[ZabbixSeeker]

A vulnerability for full remote code execution on PHP applications was released today. It was also hotpatched today.

This is super critical.

Do we have any information on when Zabbix will patch zabbix in its docker container?

[ZabbixSeeker]

Here is a workaround for you guys meanwhile. Assuming ubuntu. Assuming php version 8.5 in your container. You can check it with php -v.
1. exec bash in the container as root.
2. apt update
3. apt install --only-upgrade -y 'php8.5-*'
4. check: dpkg-query -W php8.5-fpm .... should be at least this patch: 8.5.4-0ubuntu1.5
5. restart the web container

You are welcome.

[dsdsdk]

Thank you for workaround.

I see some php update from yesterday, but not for Alpine image, anyone know why? https://github.com/zabbix/zabbix-doc....4/Dockerfiles

[ZabbixSeeker]

The images are still outdated. They need to rebuild.

The change you're referring to at this point has in itself no meaningful security implications either.

[ZabbixSeeker]

There will probably be an implicit unintended patch when the image for the next zabbix patch version 7.0.33(?) is released, if the one who builds it doesn't build it with docker cache on. My expectations regarding any other actions, at least in reasonable time, is low.

[aqualkenbush]

I use the Alpine Linux 3.2.1 container for Zabbix, here are my notes for fixing this, similar to what is shown above for apt.

## enter the container as root
docker container exec -u 0 -it zabbix-web-nginx-pgsql /bin/bash

## see your current version, I was at 8.3.19
php-fpm83 --version

## update repo cache
apk update

## list package
apk search php-fpm83

## install
apk upgrade php83-fpm

YMMV, can't tell if this breaks anything, but I haven't seen any issues yet.

[aqualkenbush]

Left out above, you probably also want to upgrade the php83-common package.

Also in the container, for that other PHP vulnerability, CVE-2026-115560:

cat > /etc/php.d/99-security.ini <<'EOF'
session.upload_progress.enabled=0
EOF

Then restart the container.

[GermanFP]

In my case, I use Docker Compose with Nginx on an Alpine image.

I followed these steps:

- I logged into the container as root.
- I ran the update command for PHP only: `apk upgrade $(apk info | grep ‘^php84’)`
- Then I restarted the container.

[PeterStegemannSIX]

https://www.zabbix.com/pr/pr912

Their statement does not sound like they plan to release fixed images anytime soon, so to say.