Question 1

How to fix the critical unauthenticated PHP RCE vulnerability in eLabFTW (GHSA-6wmf-4rv5-p3rp / GHSA-w8hw-w9fx-j79w)?

Accepted Answer

Upgrade your eLabFTW container image immediately: use version 6.0.9 or later for the 6.x branch, or 5.6.15 or later if you are still on the 5.x branch. These releases contain patched PHP packages from Alpine that fix the two critical unauthenticated remote code execution vulnerabilities. Until you can upgrade, apply mitigations: (1) configure your front proxy or WAF to block multipart/form-data uploads from reaching PHP (the standard eLabFTW nginx/php-fpm config combined with blocked multipart requests is a strong mitigation), or (2) if you cannot block multipart requests, take the instance offline. Full mitigation details: https://markdown.page/AzvY2d69. Note that blocking multipart requests is only partial protection — only upgrading makes you 100% safe.

Question 2

Why does ElabFTW 5.5.11 throw 'Call to undefined method emitLog' when importing compounds via CSV?

Accepted Answer

This is a known bug in ElabFTW 5.5.11 where the logger is not properly implemented in CompoundsCsv.php. The import crashes after the first compound. To fix it, either wait for the next stable release (5.5.12+) or manually replace the file `src/Import/CompoundsCsv.php` with the corrected version from the main branch on GitHub. Download it from https://raw.githubusercontent.com/elabftw/elabftw/main/src/Import/CompoundsCsv.php and overwrite the existing file in your installation, then restart the service. The command `bin/console import:compounds` will then work as expected.

Question 3

Why can't I delete or edit spreadsheet files in grid view after upgrading OpenProject to 5.5.8?

Accepted Answer

This is a known regression in version 5.5.8 where the contextual menu for .xlsx files in grid view no longer shows actions like delete, edit filename, upload new version, archive, or more information. As a temporary workaround, downgrade to 5.3.9 where these features worked correctly. Watch issue #6773 for a permanent fix.

Question 4

Why does a new eLabFTW experiment created from a template already contain attachments from a previous experiment?

Accepted Answer

This is a known eLabFTW bug (#6592), especially affecting templates created before an upgrade and observed on version 5.5.5. Attachment data from a previously created experiment could incorrectly carry over to a new experiment created from the same template. Fix it by having your system administrator update eLabFTW to the latest patch release that includes the fix for issue #6592. For a Docker Compose installation, the usual update steps are: `cd` into the eLabFTW directory, then run `docker compose pull && docker compose up -d`. After upgrading, create a new experiment from the template to verify it starts with no attachments. Attachments already copied into existing experiments must be removed manually.

Question 5

How to fix 'Error decrypting config value ts_password: Integrity check failed' after eLabFTW update?

Accepted Answer

This error means the SECRET_KEY in your config (/etc/elabftw.yml) no longer matches the key originally used to encrypt the timestamping password (often happens if the config file was regenerated or the SECRET_KEY value changed). Two fixes: 1) Preferred: restore the original SECRET_KEY in /etc/elabftw.yml and restart the containers (`elabctl restart` or `docker compose up -d`), so all encrypted values decrypt again. 2) If the original key is lost, clear the encrypted value so the app can start: `docker exec -it mysql mysql -u elabftw -p elabftw -e "UPDATE config SET conf_value = '' WHERE conf_name = 'ts_password';"` then log into the web interface and re-enter the Trusted Timestamping (TSA) password in the Sysconfig/Admin panel. Note that with a new SECRET_KEY, other encrypted values may also need to be re-entered.

elabftw

Core Features

What It Can't Do

Use Cases

Tags

Getting Started

Similar Projects