Server error on attachment deletion in admin cp

[nocte]

Affected version

XF 2.3.7

I found this server error in my logs:

Error: Call to a member function delete() on null src/XF/Admin/Controller/AttachmentController.php:113
Generated by: *** 28.8.2025 at 20:17
Stack trace
#0 src/XF/Mvc/Dispatcher.php(362): XF\Admin\Controller\AttachmentController->actionDelete(Object(XF\Mvc\ParameterBag))
#1 src/XF/Mvc/Dispatcher.php(264): XF\Mvc\Dispatcher->dispatchClass('XF:Attachment', 'Delete', Object(XF\Mvc\RouteMatch), Object(***\***\XF\Admin\Controller\AttachmentController), NULL)
#2 src/XF/Mvc/Dispatcher.php(121): XF\Mvc\Dispatcher->dispatchFromMatch(Object(XF\Mvc\RouteMatch), Object(***\***\XF\Admin\Controller\AttachmentController), NULL)
#3 src/XF/Mvc/Dispatcher.php(63): XF\Mvc\Dispatcher->dispatchLoop(Object(XF\Mvc\RouteMatch))
#4 src/XF/App.php(2824): XF\Mvc\Dispatcher->run()
#5 src/XF.php(806): XF\App->run()
#6 admin.php(15): XF::runApp('XF\\Admin\\App')
#7 {main}
Request state
array(4) {
  ["url"] => string(29) "/admin.php?attachments/delete"
  ["referrer"] => string(107) "https://www.***.***/admin.php?attachments/&content_type=conversation_message&username=***"
  ["_GET"] => array(1) {
    ["attachments/delete"] => string(0) ""
  }
  ["_POST"] => array(5) {
    ["_xfToken"] => string(8) "********"
    ["attachment_ids"] => array(4) {
      [0] => string(8) "13692599"
      [1] => string(8) "13692068"
      [2] => string(8) "13692022"
      [3] => string(8) "13692013"
    }
    ["_xfResponseType"] => string(4) "json"
    ["_xfWithData"] => string(1) "1"
    ["_xfRequestUri"] => string(81) "/admin.php?attachments/&content_type=conversation_message&username=***"
  }
}

I don't really know what happened, maybe a race condition?

The code in AttachmentController is:

        if ($this->isPost() && !$this->request->exists('delete_attachments'))
        {
            foreach ($attachmentIds AS $attachmentId)
            {
                /** @var \XF\Entity\Attachment $attachment */
                $attachment = $this->em()->find(\XF\Entity\Attachment::class, $attachmentId);
                $attachment->delete(false);
            }
            return $this->redirect($this->buildLink('attachments', null, $linkFilters));
        }

I think XF should first check $attachment before it executes the delete() method.