Blesta published a security advisory on 30 September 2026 alongside the 6.0.3 patch release. It covers Blesta 6.0.0 through 6.0.2 and rates the overall impact High, based on the most severe of several issues. Blesta has not disclosed the individual vulnerabilities, components, or CVE IDs. External researchers reported some issues under Blesta's Responsible Disclosure Policy, and Blesta's team found the rest internally.
Your billing system holds client records, stored payment tokens, and the API credentials for every provisioning module. That makes it a higher-value target than any single hosting server. If you upgraded to Blesta 6.0 Paradigm in August or September, you are on an affected build.
Which installs are affected
| Installed version | Action |
|---|---|
| 6.0.0, 6.0.1, 6.0.2 | Apply the 6.0.3 patch |
| Earlier than 6.0.0 | Blesta's advisory says to upgrade to 6.0.3 Full |
| 6.0.3 or later | No action for this advisory |
The installed version is shown in the admin footer as Installed Version. Patch archives only apply within their own minor release, so a 5.x install cannot use the 6.0.3 patch. A 5.x to 6.0 upgrade is a full upgrade. It needs PHP 8.2 or later, it converts tables to utf8mb4, and it moves the cache to cache_blesta/ above the docroot, so read Blesta's v6 migration guide before you start.
What else 6.0.3 fixes
Apart from the security work (logged as CORE-6197, "undisclosed security hardening"), 6.0.3 is a bug-fix release. These items are most likely to matter on a live install:
- Square: payments failed to record because
validate()still called Square's retired Transactions API (CORE-6028). - Stripe Payments: webhooks for authorise/capture payments failed to correlate transactions and logged "Transaction could not be applied to invoices" (CORE-6141). ACH collection moves from legacy bank account tokens to PaymentMethods (CORE-6126).
- Staff ACLs: staff navigation links showed for users without the matching ACL permission (CORE-6204).
- Support Manager: radio and dropdown custom fields did not save (CORE-6210).
- Order: client package counts loaded every service, which caused timeouts for clients with many services (CORE-6190).
- Registrars: several fixes for Nominet and OpenSRS (CORE-6157, CORE-6158).
If you run Stripe Payments in Blesta, check for invoices left unpaid by the webhook bug. Look for unapplied transactions created since your 6.0 upgrade and apply them by hand.
Apply the 6.0.3 patch
- Back up the Blesta files and the database. Blesta does not do this for you.
- Download the 6.0.3 patch from the Download Manager at account.blesta.com, under Patches, and check its SHA256 sum against the one in the release announcement.
- Unzip the archive and upload its contents over your existing install.
- Run the upgrader from the Blesta root:
cd /home/billing/public_html/blesta
php ./index.php admin/upgrade -y
Or open /admin/upgrade in a browser and click Continue with Upgrade. Then confirm the footer shows 6.0.3.
If the upgrader stops partway, run SELECT value FROM settings WHERE key='database_version'; to find the last migration that completed. Blesta's upgrade docs explain how to resume from the next task in /components/upgrades/tasks/.
What versions does the Blesta 6.0.3 security advisory affect?+
Are there CVE numbers for the Blesta 6.0.3 vulnerabilities?+
How do I upgrade Blesta from the command line?+
Can I apply the Blesta 6.0.3 patch to Blesta 5.13?+
Do I need an active license to download Blesta 6.0.3?+
Next steps
- Check your update entitlement and renewal terms in Blesta license pricing: Owned vs Leased, or renew through the Blesta license page.
- After patching, test provisioning end-to-end with Blesta cPanel provisioning.
- Moving off WHMCS onto a patched 6.0.3? Work through the WHMCS to Blesta migration checklist.