MachForm v30 is now available. This release resolves a critical security vulnerability affecting all previous versions of MachForm. We strongly recommend updating your installation as soon as possible.
For full details about this release, please see the MachForm v30 Release Announcement.
Option 1: Upgrade to MachForm v30 (Recommended)
The recommended path is to upgrade to the latest version of MachForm. v30 includes the security fix along with other improvements and bug fixes.
Requirements:
PHP 8.1 or higher
MySQL 5.7 or higher
Download:
Upgrade Guide:
Please follow our official upgrade guide: Upgrading MachForm Self-Hosted
Option 2: Security Patches for Earlier Versions
If you are unable to upgrade to v30 immediately (for example, because your server does not yet meet the PHP 8.1 or MySQL 5.7 requirements, or due to other constraints) we have prepared targeted security patches for earlier MachForm versions.
These patches contain only the fix for the critical security vulnerability and do not include other v30 changes.
Select the patch matching your current MachForm version:
MachForm Version | Patch Download |
v29 | |
v28 | |
v27 | |
v26 | |
v25 | |
v24 | |
v23 | |
v22 | |
v21 | |
v20 |
How to apply a security patch?
Download the patch package for your current MachForm version.
Back up your existing MachForm files and database before applying the patch.
Extract the patch files and upload them to your MachForm installation, overwriting the existing files at the same paths.
Verify that your MachForm installation still works correctly by logging in and viewing a form.
Need Help?
If you have questions about which option to choose, need assistance with the upgrade or patch application, or run into any issues, we are here to help.
Open a support ticket: https://www.machform.com/contact/
Email: support@appnitro.com
FAQ
Do I need to apply this update if I use MachForm Cloud?
No. If you use MachForm Cloud, the fix has already been applied to our hosted infrastructure. No action is required on your part.
How urgent is this update?
This is a critical security update. We recommend applying it as soon as possible. If you are unable to upgrade to v30 right away, please apply the security patch for your current version in the meantime.
What does this vulnerability affect?
The vulnerability is in the authentication logic and could allow an unauthenticated attacker to gain read-only access to the MachForm administrative interface under specific conditions. Full technical details will be published in the CVE database.