security: fixed critical PHP-RCE-Vulnerabilities CVE-2026-109618 and CVE-2026-109619

References:

https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.pdf?__blob=publicationFile&v=3
https://www.php.net/archive/2026.php

Dockerfile

@@ -8,7 +8,7 @@ RUN npm run build \
     && test -s dist/app.js \
     && test -s dist/index.html
 
-FROM php:8.3.33-apache-bookworm
+FROM php:8.3.36-apache-bookworm
 
 ENV TZ=Europe/Berlin \
     PLAYWRIGHT_BROWSERS_PATH=/ms-playwright \

README.md

@@ -327,7 +327,6 @@ HA_BASE_URL=
 HA_TOKEN=
 OPENWEATHER_API_KEY=
 VBB_ACCESS_ID=
-VBB_API_BASE_URL=https://vbb.demo.hafas.cloud/api/fahrinfo/latest
 
 # Contentpanel / Aushang-Formatüberführung
 OLLAMA_GATEWAY_URL=https://ollama.pelpino.de

docker-compose.local.yml

@@ -28,7 +28,6 @@ services:
       HA_TOKEN: "${HA_TOKEN:-}"
       OPENWEATHER_API_KEY: "${OPENWEATHER_API_KEY:-}"
       VBB_ACCESS_ID: "${VBB_ACCESS_ID:-}"
-      VBB_API_BASE_URL: "${VBB_API_BASE_URL:-https://vbb.demo.hafas.cloud/api/fahrinfo/latest}"
       OLLAMA_GATEWAY_URL: "${OLLAMA_GATEWAY_URL:-https://ollama.pelpino.de}"
       OLLAMA_API_KEY: "${OLLAMA_API_KEY:-}"
       OLLAMA_AUTH_HEADER: "${OLLAMA_AUTH_HEADER:-Authorization}"

docker-compose.yml

@@ -24,7 +24,6 @@ services:
       HA_TOKEN: ${HA_TOKEN:?set HA_TOKEN}
       OPENWEATHER_API_KEY: ${OPENWEATHER_API_KEY:?set OPENWEATHER_API_KEY}
       VBB_ACCESS_ID: ${VBB_ACCESS_ID:?set VBB_ACCESS_ID}
-      VBB_API_BASE_URL: ${VBB_API_BASE_URL:?set VBB_API_BASE_URL}
       OLLAMA_GATEWAY_URL: ${OLLAMA_GATEWAY_URL:-https://ollama.pelpino.de}
       OLLAMA_API_KEY: ${OLLAMA_API_KEY:-}
       OLLAMA_AUTH_HEADER: ${OLLAMA_AUTH_HEADER:-Authorization}

web/intranet_repo/projects/dashboard/util/vbb.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 const DASHBOARD_VBB_STOP_ID = '900086103';
 const DASHBOARD_VBB_BUS_PRODUCTS = 8;
+const DASHBOARD_VBB_API_URL = 'https://fahrinfo.vbb.de/restproxy/latest/departureBoard';
 
 function dashboard_vbb_datetime(array $departure, bool $realtime = false): ?DateTimeImmutable
 {
@@ -67,18 +68,17 @@ function dashboard_fetch_departures(): array
         if (microtime(true) >= ($cache['retryAt'] ?? 0)) {
             try {
                 $query = http_build_query([
+                    'accessId' => intranet_env('VBB_ACCESS_ID'),
                     'id' => DASHBOARD_VBB_STOP_ID,
                     'duration' => 120,
                     'maxJourneys' => 30,
                     'products' => DASHBOARD_VBB_BUS_PRODUCTS,
+                    'rtMode' => 'SERVER_DEFAULT',
                     'type' => 'DEP',
                     'format' => 'json',
                     'lang' => 'de',
                 ], '', '&', PHP_QUERY_RFC3986);
-                $baseUrl = rtrim(intranet_env('VBB_API_BASE_URL'), '/');
-                $data = dashboard_http_json($baseUrl . '/departureBoard?' . $query, [
-                    'Authorization: Bearer ' . intranet_env('VBB_ACCESS_ID'),
-                ]);
+                $data = dashboard_http_json(DASHBOARD_VBB_API_URL . '?' . $query);
                 if (!isset($data['Departure']) || !is_array($data['Departure'])) {
                     throw new RuntimeException('Unerwartete VBB-Antwort.');
                 }