Skip to content

Cloudlog

v2.8.15 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

amateur-radio cloudlog ham-radio logging php qsl
+2 more
qso web-based-logger

Affected surfaces

auth rce_ssrf

Summary

AI summary

Hardened database queries by enforcing numeric IDs, improving security against exploits.

Full changelog

Cloudlog Version 2.8.15 Changelog

This update focuses heavily on "under the hood" improvements to make Cloudlog faster, more secure, and more reliable. We have also squashed a few bugs and improved how the system handles radio data.

Here is a breakdown of what has changed in this latest release.

Security and Performance Improvements

The vast majority of work in this version involved cleaning up the database queries that Cloudlog uses to fetch your logbook data, awards, and statistics.

  • Hardened Database Queries: We have updated how the software talks to the database across almost all modules (including Contesting, Awards, OQRS, Gridmaps, and Labels). By strictly enforcing that ID numbers are treated purely as numbers, the system is much more secure against potential database exploits.
  • Under the Hood Modernisation: A lot of old, custom database code has been swapped out for modern framework tools. This makes the code easier to maintain and improves loading speeds for large logbooks.
  • Improved Session Security: For those running their own servers, Cloudlog now creates isolated temporary folders for user sessions and automatically generates unique encryption keys during installation. This stops different applications on the same server from interfering with your Cloudlog data.

Features and Bug Fixes

  • Better Satellite Lookups: We have improved the way Cloudlog detects when you are operating via satellite. The system now caches your last CAT (Computer Aided Transceiver) radio data, making satellite lookups much more reliable when your radio automatically populates fields in the UI.
  • Pagination Language Support: Fixed the "Previous" and "Next" buttons on your log pages. They now correctly use your selected language pack rather than defaulting strictly to English.
  • Logbook Data Cleaning: Fixed an issue where leaving certain numeric fields blank (like age or index fields) could cause database errors. Cloudlog now correctly recognises these empty spaces as blank rather than trying to process them as invalid data.
  • Release Notification Reset: When you log in after this update, you will see a fresh release dialogue box highlighting that you are now running version 2.8.15.

Maintenance

  • Updated several behind-the-scenes software libraries (including form-data and tmp) to their latest versions to ensure ongoing stability.

Security Fixes

  • Database queries now strictly enforce numeric IDs to prevent injection exploits
  • Session handling creates isolated temporary folders and unique encryption keys per installation

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Cloudlog

Get notified when new releases ship.

Sign up free

About Cloudlog

Log your amateur radio contacts anywhere.

All releases →

Related context

Beta — feedback welcome: [email protected]