Xerte Community website Online again
As perhaps some of you have noticed, this website has been offline for a few weeks. We're happy to announce that we've worked hard to update the website to the latest version of Joomla. In this blog we would like to share what happened and why we took the decision to take the website offline.
What happened
In the week of June 12 there were numerous messages on the internet about serious vulnerabilities in one of the extensions of Joomla (JCE). We established that we did not use JCE on the community website and that no immediate action was required. However a few days later it also became apparent that there were similar vulnerabilities found in 2 other extensions that the community website does use: SP PageBuilder and the Helix Framework. Both extensions had unauthenticated RCE vulnerabilities, meaning that any visitor would be able to upload arbitrary php files to the website and execute those. That is when we put the website in maintenance to protect the content and any personal data.
Why did it take so long to bring it online again
First of all, apologies for any inconvenience the downtime caused for you or your organisation, but the website is maintained and hosted by volunteers and they are not available 24/7. The community website uses several big extensions that do not always work nicely together. So, we needed a lot of attempts of backing up, trying upgrading the website in steps, documenting those steps and restoring the website when something went wrong and we lost all the downloads, or all the Forum messages. At some point last week, we had a documented way to update/upgrade all the extensions and the core Joomla without losing data, but there were still annoying things that were not working properly, such as the top of the Forum disappearing behind the banner of the template, the login form having huge icons and the login button of the forum not working. Those have all now been fixed and we have decided it is good enough to place the website online again.
Current Status
We believe the core functionality (Forum, News articles, Download section, wiki) are up and running again. We're ging to test all the other features in the coming days (Mailing system, Registration form of Xerte installations) and fix those if needed.
What can you do
If you encounter an issue with the website, please drop us a mail or place a message in the forum so we can have a look at the issue and fix it if needed.
Was Xerte Online Toolkits affected
Xerte Online Tookits itself was never affected. The website was not hacked or compromised as far as we can tell. We used a special security tool to verify it was indeed not compromised. We took it offline as a precaution. Furthermore, the source code of Xerte is not stored on the website but on GitHub. However, each Xerte installation does point to the community website for several resources, such as the examples that you can reach from the insert pages menu and the links to the wiki from the top of the wizard. Those resources were offline and thus did not work for any Xerte Installation, but Xerte itself was not compromised or in any other way affected by the downtime of the community website.
Next steps
As indicated above, the website is up and running again. We will monitor Joomla and its extensions for CVE's closely and will follow up with updates if needed.
Regards,
The Xerte Team
- News
- Hits: 7
Please save the date for this year's Xerte Conference - Wednesday 18 November 2026. The Xerte Project team are looking forward to another exciting event later in the year and invite you to get involved.
Xerte vulnerabilities – fixes available in v3.15.4-36 and v3.14.5-11
We’re pleased to announce that the newest version of Xerte, version 3.15, is now available for