From 6d230ce3f851e3ec6daab5d46ae389752ff65c5e Mon Sep 17 00:00:00 2001 From: lacatoire Date: Thu, 5 Feb 2026 11:57:53 +0100 Subject: [PATCH 1/4] Add security warning about publicly exposed PHP-FPM --- install/fpm/configuration.xml | 9 +++++++++ install/fpm/index.xml | 15 +++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/install/fpm/configuration.xml b/install/fpm/configuration.xml index e33c099864ce..10eb61281c1d 100644 --- a/install/fpm/configuration.xml +++ b/install/fpm/configuration.xml @@ -251,6 +251,15 @@ 'ip.add.re.ss:port', 'port', '/path/to/unix/socket'. This option is mandatory for each pool. + + + Prefer Unix sockets over TCP sockets when the web server runs on + the same host. If a TCP socket must be used, ensure it is not + exposed to untrusted networks and restrict access using + listen.allowed_clients. + An exposed FastCGI endpoint allows arbitrary code execution. + + diff --git a/install/fpm/index.xml b/install/fpm/index.xml index c4644a0e232e..83c29fbc216b 100644 --- a/install/fpm/index.xml +++ b/install/fpm/index.xml @@ -3,6 +3,21 @@ FastCGI Process Manager (FPM) &fpm.intro; + + + PHP-FPM must not be publicly exposed to the network. A FastCGI + endpoint that is accessible from untrusted sources allows + arbitrary code execution. When using TCP + sockets, restrict access using the + listen.allowed_clients + directive to allow connections from the web server only. Prefer + Unix sockets over TCP sockets when the web server runs on the same + host, as they can be protected with filesystem permissions. When + using Docker or similar container setups, do not expose PHP-FPM + ports to the host or external networks; communicate between + containers using an internal network instead. + + These features include: From 7cf7ade26e5688b248cfd179f12f497f52685142 Mon Sep 17 00:00:00 2001 From: lacatoire Date: Wed, 2 Sep 2026 09:51:42 +0200 Subject: [PATCH 2/4] docs(fpm): add fastcgi_abort_request reference alongside fastcgi_finish_request --- install/fpm/index.xml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/install/fpm/index.xml b/install/fpm/index.xml index 83c29fbc216b..8033f3f9ea15 100644 --- a/install/fpm/index.xml +++ b/install/fpm/index.xml @@ -57,8 +57,9 @@ - fastcgi_finish_request - special function to finish - request and flush all data while continuing to do something + fastcgi_finish_request and + fastcgi_abort_request - special functions to finish + or abort a request and flush all data while continuing to do something time-consuming (video converting, stats processing etc.); From e157b09b0e1290df78cbd9c353d28433c1dd93fc Mon Sep 17 00:00:00 2001 From: lacatoire Date: Wed, 2 Sep 2026 09:55:18 +0200 Subject: [PATCH 3/4] fix(fpm): use for inline-only listitem paragraphs --- install/fpm/index.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/install/fpm/index.xml b/install/fpm/index.xml index 8033f3f9ea15..55451cff6a82 100644 --- a/install/fpm/index.xml +++ b/install/fpm/index.xml @@ -56,12 +56,12 @@ - + fastcgi_finish_request and fastcgi_abort_request - special functions to finish or abort a request and flush all data while continuing to do something time-consuming (video converting, stats processing etc.); - + From af62566f6c39734bb35a15190c7061296f8b3f07 Mon Sep 17 00:00:00 2001 From: Louis-Arnaud Date: Wed, 2 Sep 2026 15:55:44 +0200 Subject: [PATCH 4/4] fpm: drop the invented fastcgi_abort_request and tighten the warnings fastcgi_abort_request() does not exist: the FPM SAPI only declares fastcgi_finish_request(). The conversion the style check requires is kept. The chapter warning now states the mechanism instead of asserting the risk, and moves after the feature list so it no longer splits the sentence introducing it. The listen warning carries the operational detail, names listen.owner and the BSD caveat, and no longer repeats the chapter. --- install/fpm/configuration.xml | 16 ++++++++++++---- install/fpm/index.xml | 34 ++++++++++++++++------------------ 2 files changed, 28 insertions(+), 22 deletions(-) diff --git a/install/fpm/configuration.xml b/install/fpm/configuration.xml index 10eb61281c1d..e2396d9482cd 100644 --- a/install/fpm/configuration.xml +++ b/install/fpm/configuration.xml @@ -253,11 +253,19 @@ - Prefer Unix sockets over TCP sockets when the web server runs on - the same host. If a TCP socket must be used, ensure it is not - exposed to untrusted networks and restrict access using - listen.allowed_clients. An exposed FastCGI endpoint allows arbitrary code execution. + When the web server runs on the same host, a Unix socket should be + preferred; on Linux its access is then controlled by + listen.owner, + listen.group and listen.mode, + although many BSD-derived systems accept connections regardless of + those permissions. + When a TCP socket is used, the addresses allowed to connect must be + listed in + listen.allowed_clients, + which is unset by default and then accepts any address. + In container setups, the FPM service should not publish its port on + the host; containers on the same network reach each other directly. diff --git a/install/fpm/index.xml b/install/fpm/index.xml index 55451cff6a82..f466595a00d8 100644 --- a/install/fpm/index.xml +++ b/install/fpm/index.xml @@ -3,21 +3,6 @@ FastCGI Process Manager (FPM) &fpm.intro; - - - PHP-FPM must not be publicly exposed to the network. A FastCGI - endpoint that is accessible from untrusted sources allows - arbitrary code execution. When using TCP - sockets, restrict access using the - listen.allowed_clients - directive to allow connections from the web server only. Prefer - Unix sockets over TCP sockets when the web server runs on the same - host, as they can be protected with filesystem permissions. When - using Docker or similar container setups, do not expose PHP-FPM - ports to the host or external networks; communicate between - containers using an internal network instead. - - These features include: @@ -57,9 +42,8 @@ - fastcgi_finish_request and - fastcgi_abort_request - special functions to finish - or abort a request and flush all data while continuing to do something + fastcgi_finish_request - special function to finish + request and flush all data while continuing to do something time-consuming (video converting, stats processing etc.); @@ -82,6 +66,20 @@ + + + php-fpm must not be reachable from an untrusted network. + A client that can open a FastCGI connection controls the + configuration used for the request, including + auto_prepend_file, + and can therefore execute arbitrary code. + Access is restricted through the + listen and + listen.allowed_clients + directives. + + + &install.fpm.install; &install.fpm.configuration;