Core - General

• Security hardening in Smarty template identifier handling to prevent a potential SSTI/LFI/RCE attack chain;


• Restored frontend rendering of valid module database/file templates while keeping Smarty template identifier hardening against unsafe resource/path access;


• Restored valid frontend Smarty string/eval rendering for modules using parsed template content while keeping unsafe path-style template identifiers blocked;


• Compatibility fixes for PHP 8.1, 8.2, 8.3, 8.4 and 8.5 in active runtime paths;


• Hardened session and authentication-related cookies with explicit HttpOnly, Secure-on-HTTPS and SameSite handling, with a config opt-out for SameSite if needed for legacy integrations;


• PHPMailer upgraded to version 6.12.0;

Content Manager 1.1.15

• Content copy flow now uses content_id 0 for new unsaved copied content while keeping backward compatibility;


• Added a missing default-page content type error message;


• Changing the page design now keeps the template selector usable even when the selected design has no explicit page-template associations;

DesignManager 1.2.0

• Export now skips missing or unreadable referenced assets, writes an export report and records warnings in the audit log;


• Import now handles malformed or non-design uploads more gracefully instead of triggering fatal errors or breaking the admin flow;

FileManager 1.6.17

• Add support for WEBP and AVIF image types for thumbnails generation, rotation or crop operations. Note: AVIF operations will not work on PHP7;

MicroTiny 2.2.6

• Removed stale TinyMCE plugin loader references that could trigger missing plugin warnings;

ModuleManager 2.2.0

• Finalized the refreshed ModuleManager release line for CMSMS 2.2.23;

Search 1.55

• Finalized the Search module version for this release line;

News 2.51.14

• Fixed BR #12794 - News-fields typo item_orderr;

UserGuide 1.1

• Finalized the UserGuide module version for this release line;