Chevereto V4.5.8 introduces important security patches that address vulnerabilities affecting older versions of Chevereto, including versions dating back to 3.0.0. This announcement explains the scope of these findings, their potential impact, and what they mean for existing installations.
In April 2025, I announced our commitment to security vulnerability disclosure. As part of that effort, Chevereto V4.5.8 underwent the largest security review in the project's history. I reviewed the entire codebase, with additional contributions from several independent security researchers. This work yielded 19 security fixes (8 moderate, 7 high, 4 critical).
# How are you affected?
The impact of these vulnerabilities depends on how you run and use Chevereto.
If you operate a multi-tenant installation or a public image-hosting service where users can upload and share files, your exposure will be higher. Depending on the vulnerability, an attacker could access sensitive user-generated content, or cause a denial of service on your website.
If you run a private, single-user installation for your own use, your exposure is much lower, and several attack scenarios may not apply to you at all.
The details and PoC of these vulnerabilities will be disclosed in two weeks from now. My objective is for everybody to have plenty of time to patch without needing to rush things. Discretion in this matter is essential to protect your installations. I will wait as long as feasible.
# Critical (4)
>= 4.0.0, < 4.5.8>= 4.0.3, < 4.5.8>= 3.0.0, < 4.5.8(2)
# High (7)
>= 3.0.0, < 4.5.8(2)>= 3.7.0, < 4.5.8>= 3.12.0, < 4.5.8>= 4.0.0, < 4.5.8>= 4.0.11, < 4.5.8>= 4.3.0, < 4.5.8
# Moderate (8)
>= 3.0.0, < 4.5.8(4)>= 3.5.14, < 4.5.8>= 3.7.0, < 4.5.8>= 3.8.4, < 4.5.8>= 3.12.0, < 4.5.8
# Chevereto V3 & Chevereto-Free
Many websites are using Chevereto V3 despite being EOL since 2022-11: 35% of our user base according to W3Techs. The same goes for Chevereto-Free (unknown usage) which was superseded by chevereto/chevereto.
The best way to get your systems secured is to update to the V4 branch. You can go with any edition as both the Open Source edition and paid editions bundle the same security patches.
# Helping everybody upgrade
Our priority is to help all affected installations move to a secure, patched version. To support that effort, the Chevereto Pro subscription has been recently upgraded to provide all-service support, which includes on-site system updates. If you have any issues updating, we will perform the update on your behalf at no extra charge so you can rest assured your website will work as expected.
We have prepared discount coupons of up to 80% off for all former customers within 5 years of their last activity. The discount takes previous purchases into account, helping us make the upgrade more accessible to those who have supported Chevereto over the years. If you are a former customer, visit chevereto.com/panel/coupons to redeem your long-time customer discount.
# Chevereto Cloud
Chevereto Cloud users aren't affected as the patches have already been implemented. There's no action required for Chevereto Cloud customers.
Feel free to contact us if you want to migrate your self-hosted website to the cloud.
# Thanks
I would like to thank all the security researchers who participated in this process. They are now permanently listed in our Hall of fame: