We have released security hotfixes for all supported XNAT release lines: XNAT 1.10.2.1, XNAT 1.9.3.9, and XNAT 1.8.10.6.
A security vulnerability in XNAT allows an unauthenticated attacker to obtain an account with privileges up to and including site administrator. Site administrator privileges give the attacker full control of the XNAT site and all its data.
To exploit the vulnerability, the attacker must be able to reach the site's web interface. If access is restricted by a firewall or VPN, the attacker must first have access to the restricted network.
All sites should update immediately to the patched version for their release line, or to a newer compatible version. Sites that cannot update immediately should contact security@xnat.org for temporary mitigation steps.
Sites running older, unsupported versions of XNAT should upgrade to a supported release line as soon as possible.
These releases do not introduce plugin compatibility changes. Release notes: 1.10.2.1 | 1.9.3.9 | 1.8.10.6. For upgrade instructions, see How To Upgrade XNAT. Download at www.xnat.org/download.