All our EE2 sites are displaying:

"An ExpressionEngine version 2.11.6, build 20170207 has been released as a security release"

Does anyone have any details about what security vulnerabilities are being addressed? Are they specific to version 2.11 or a general security vulnerability in all EE2 sites?

2 Answers 2


You'll discover all patch notes here in the changelog.

Security patches are a combination of both EE & underlying frameworks. EE is pretty resilient and a lot of security issues are more server side orientated.

  • Thanks Stuart. I’m also trying to find out how far back the system vulnerability goes. We’ve built 200+ EE2 sites, and we’re trying to see how many of them are affected. Like, do all of them have the security bug or just the ones running EE2.8+? Commented Feb 10, 2017 at 13:30

I found out from Robin Sowell with Ellis Lab that the latest security release fixes a previously unknown issue in CodeIgnitor, which is at the core of version 2.

So this definitely affects all installs of EE2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.