# New Release: v4.11.1 ~ Rebel Rebel

**URL:** <https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310>\
**Category:** Announcements\
**Created:** [February 19, 2025, 9:20am UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310 "2025-02-19T09:20:19Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Phiba](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/phiba/32/1784_2.png) [@Phiba](https://community.passbolt.com/u/Phiba)\
**Post date:** [February 19, 2025, 9:20am UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/1 "2025-02-19T09:20:19Z")

</div>

v4.11.1 ~ Rebel Rebel

Release Date: 18th February, 2025

🎶 [Rebel Rebel](https://www.youtube.com/watch?v=U16Xg_rQZkA) 🎶

Passbolt v4.11.1 API is out. This is a minor security update to address a host header injection vulnerability. This update adds a new flag to help mitigate the risk for misconfigured servers.

If you’re running Passbolt, we strongly recommend reviewing the release notes and update as needed.

🔗 Read the release notes: [https://hubs.li/Q0377hlh0](https://hubs.li/Q0377hlh0)

🔗 Incident report details: [https://www.passbolt.com/incidents/host-header-injection](https://www.passbolt.com/incidents/host-header-injection)

Special thanks to security researcher David Silva for reporting the issue. We appreciate everyone who contributed to making passbolt more secure. ❤

If you have any questions, suggestions, or feedback, feel free to share them here in the [Passbolt Community Forum](https://community.passbolt.com/).

---

<div class="post-metadata">

**Author:** ![LuckySecret](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/luckysecret/32/4689_2.png) [@LuckySecret](https://community.passbolt.com/u/LuckySecret)\
**Post date:** [March 10, 2025, 11:01am UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/2 "2025-03-10T11:01:21Z")

</div>

Hello there,  
According to the documentation found here : [https://github.com/passbolt/passbolt\_browser\_extension/releases](https://github.com/passbolt/passbolt_browser_extension/releases)  
It’s recommended to migrate to PHP 8.2 (to prep for v5).

Yet the setup script is forcing 8.1.  
How could we upgrade to 8.2 then ? Is it safe to overwrite the file ?

Thanks

---

<div class="post-metadata">

**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\
**Post date:** [March 10, 2025, 1:33pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/3 "2025-03-10T13:33:07Z")

</div>

> [@LuckySecret](#):
>
> Yet the setup script is forcing 8.1.  
> How could we upgrade to 8.2 then ? Is it safe to overwrite the file ?

Can you link to the file are you are mentioning? To make sure we’re talking about the same thing / to answer. Thanks,

---

<div class="post-metadata">

**Author:** ![max](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/max/32/1528_2.png) [@max](https://community.passbolt.com/u/max)\
**Post date:** [March 10, 2025, 1:35pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/4 "2025-03-10T13:35:24Z")

</div>

Can you precise your distribution? We are gonna publish a blog article later today to provide strategies for the migration from php \< 8.2 to 8.2.

Thanks.

---

<div class="post-metadata">

**Author:** ![LuckySecret](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/luckysecret/32/4689_2.png) [@LuckySecret](https://community.passbolt.com/u/LuckySecret)\
**Post date:** [March 10, 2025, 2:56pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/5 "2025-03-10T14:56:53Z")

</div>

Hello,

We are RHEL based.  
I am referring to this file [download.passbolt.com/ce/installer/passbolt-repo-setup.ce.sh](https://download.passbolt.com/ce/installer/passbolt-repo-setup.ce.sh)  
Where there are explicit references to “install php:remi-8.1”

Thanks

---

<div class="post-metadata">

**Author:** ![max](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/max/32/1528_2.png) [@max](https://community.passbolt.com/u/max)\
**Post date:** [March 10, 2025, 2:59pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/6 "2025-03-10T14:59:24Z")

</div>

I can extract a section of the future blog post:

* * *

For RHEL 9/8 distro family, users who prefer to update PHP rather than migrate to a new server, here’s how to install PHP 8.2 using Remi’s repository. If you installed passbolt using our one-liner script, you already are using Remi’s repository.

Reset PHP modules and enable PHP 8.2 from Remi:

```auto
dnf module reset php -y

dnf module disable php -y

dnf module enable php:remi-8.2 -y

```

Install or update PHP 8.2 and the extensions needed for passbolt:

`dnf install -y php php-cli php-curl php-fpm php-gd php-intl php-json php-mbstring php-mysqlnd php-pecl-gnupg php-pgsql php-process php-xml php-ldap`

Verify that PHP 8.2 is now installed:

`php -v`

You should see output indicating PHP 8.2.x is installed.

Configure PHP-FPM to start automatically and start the service:

```auto
systemctl enable php-fpm

systemctl start php-fpm

```

Restart your web server:

`systemctl restart nginx`

Once PHP 8.2 is properly installed and configured, you’ll be ready for the passbolt v5 update when it becomes available in April. Remember to back up your database and passbolt configuration before performing any major version upgrade.

* * *

Let me know 🙂

---

<div class="post-metadata">

**Author:** ![shootify](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@shootify](https://community.passbolt.com/u/shootify)\
**Post date:** [March 10, 2025, 10:00pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/7 "2025-03-10T22:00:41Z")

</div>

can you please provide the guide for debian CE? i will appreciate it very much. thanks

---

<div class="post-metadata">

**Author:** ![max](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/max/32/1528_2.png) [@max](https://community.passbolt.com/u/max)\
**Post date:** [March 11, 2025, 8:31am UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/8 "2025-03-11T08:31:49Z")

</div>

#### Upgrading PHP on Debian 11 and Ubuntu 22.04 using Ondrej

For Debian 11 and Ubuntu 22.04 users who prefer to update PHP rather than migrate to a new server, here’s how to install PHP 8.2 using Ondřej Surý’s repository:

First, make sure you have a backup of your system prior to the update and let’s make now sure your system is up to date:

```auto
sudo apt update 
sudo apt upgrade

```

Add the GPG key for the Ondřej’s repository:

```auto
curl -fsSL https://packages.sury.org/php/apt.gpg | sudo gpg --dearmor -o /usr/share/keyrings/php-archive-keyring.gpg

```

Add the repository to your sources list:

```auto
echo "deb [signed-by=/usr/share/keyrings/php-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/php.list

```

Update package lists with the new repository included:

```auto
sudo apt update 

```

Install PHP 8.2 and the extensions needed for passbolt:

```auto
sudo apt install -y php8.2 php8.2-cli php8.2-common php8.2-curl php8.2-fpm php8.2-gd php8.2-intl php8.2-mbstring php8.2-mysql php8.2-opcache php8.2-xml php8.2-gnupg php8.2-pgsql php8.2-ldap

```

Verify that PHP 8.2 is now installed:

```auto
php8.2 -v

```

Configure the system to use PHP 8.2 as the default PHP version:

```auto
sudo update-alternatives --set php /usr/bin/php8.2

```

Verify that PHP 8.2 is now the default version:

```auto
php -v

```

Configure PHP-FPM to start automatically and restart the service:

```auto
sudo systemctl enable php8.2-fpm
sudo systemctl start php8.2-fpm

```

If you’re using Nginx, update your configuration to use PHP 8.2-FPM:

```auto
# Edit your passbolt nginx configuration
sudo nano /etc/nginx/sites-enabled/nginx-passbolt.conf
# Change the PHP-FPM socket path if necessary
# From: fastcgi_pass unix:/run/php/php7.4-fpm.sock;
# To: fastcgi_pass unix:/run/php/php8.2-fpm.sock;

```

Test your Nginx configuration:

```auto
sudo nginx -t

```

If the test is successful, restart Nginx:

```auto
sudo systemctl restart nginx

```

Voilà!

---

<div class="post-metadata">

**Author:** ![GewoonWalter](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/gewoonwalter/32/4880_2.png) [@GewoonWalter](https://community.passbolt.com/u/GewoonWalter)\
**Post date:** [March 11, 2025, 9:06am UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/9 "2025-03-11T09:06:51Z")

</div>

It worked perfectly, thank you very much!

---

<div class="post-metadata">

**Author:** ![Phiba](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/phiba/32/1784_2.png) [@Phiba](https://community.passbolt.com/u/Phiba)\
**Post date:** [March 11, 2025, 1:14pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/10 "2025-03-11T13:14:14Z")

</div>

The blog post is published on the website: [Preparing for Passbolt v5: PHP 8.2 Requirement](https://www.passbolt.com/blog/preparing-for-passbolt-v5-php-8-2-requirement)

---

<div class="post-metadata">

**Author:** ![max](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/max/32/1528_2.png) [@max](https://community.passbolt.com/u/max)\
**Post date:** [March 11, 2025, 4:43pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/11 "2025-03-11T16:43:57Z")

</div>

Hello @LuckySecret can you confirm that the shared procedure is working for you?

---

<div class="post-metadata">

**Author:** ![Subinsmani](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/subinsmani/32/4890_2.png) [@Subinsmani](https://community.passbolt.com/u/Subinsmani)\
**Post date:** [March 12, 2025, 1:52pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/12 "2025-03-12T13:52:44Z")

</div>

Unable to insytall Latest Version

Ubuntu OS Ubuntu 24.04.2 LTS  
PHP Version PHP v8.3  
Currently Installed Version Passbolt CE: 4.11.1-1

Trying to upgrade to 4.12.0

root@netdata:~/subins# sudo apt install passbolt-ce-server  
Reading package lists… Done  
Building dependency tree… Done  
Reading state information… Done  
passbolt-ce-server is already the newest version (4.11.1-1).  
The following package was automatically installed and is no longer required:  
mailcap  
Use ‘sudo apt autoremove’ to remove it.  
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.  
root@netdata:~/subins# sudo apt autoremove

---

<div class="post-metadata">

**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\
**Post date:** [March 12, 2025, 2:01pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/13 "2025-03-12T14:01:26Z")

</div>

> [@Subinsmani](#):
>
> Trying to upgrade to 4.12.0

Packages are still being built. Only github code has been updated atm. Come back in few hours 🙂

---

<div class="post-metadata">

**Author:** ![LuckySecret](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/luckysecret/32/4689_2.png) [@LuckySecret](https://community.passbolt.com/u/LuckySecret)\
**Post date:** [March 17, 2025, 1:18pm UTC](https://community.passbolt.com/t/new-release-v4-11-1-rebel-rebel/12310/14 "2025-03-17T13:18:01Z")

</div>

Yes I confirm (a bit late) that it worked like a charm.  
Thanks for the responsiveness