From 9219bd38016760f9d47b0dd29bd3a6fb8d3e441e Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Sun, 25 Oct 2026 14:43:22 +0100
Subject: [PATCH] disable PHP session upload progress tracking

Mitigate CVE-2026-115560 by disabling session upload progress in the PHP
configuration before PHP-FPM handles requests.
---
 rootfs/etc/php84/conf.d/override.ini | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 rootfs/etc/php84/conf.d/override.ini

diff --git a/rootfs/etc/php84/conf.d/override.ini b/rootfs/etc/php84/conf.d/override.ini
new file mode 100644
index 00000000..2f2343a1
--- /dev/null
+++ b/rootfs/etc/php84/conf.d/override.ini
@@ -0,0 +1 @@
+session.upload_progress.enabled=0