• Maintenance release with security enhancements, general improvements and bug fixes.
• Security: Resolved skipping of authentication for concurrent logins via cookie (thanks, @moltengama and @Groppoxx).
• Security: Always sandbox preview frames and introduce admin-side CSP layer (thanks, Nguyen Trung Hoang).
• Security: Sanitize 'sort' attribute of <txp:authors> tag (thanks, Neder).
• Security: Sanitize 'sort' attribute of <txp:file_download> tag (thanks, @moltengama and @Groppoxx).
• Security: Sanitize 'url_title' attribute consistently (thanks, @moltengama and @Groppoxx).
• Security: CSP improvements to mitigate user privilege CSRF (thanks, @AnhNg1410).
• Security: Theme import is now CSRF-aware (thanks, @fy0lai)).
• Security: Validate administrative user status on Users panel updates (thanks, @mansurmavlankulov).
• Security: Resolve sanitization of file paths in XML-RPC mt_uploadImage() (thanks, zsm-cry). Refer to CVE-2026-5344 for additional information.
• Fixed: FROM_UNIXTIME(0) timestamp handling on some MySQL/MariaDB versions.
• Fixed: Deleting image(s) deletes corresponding thumbnails (thanks, @rwetzlmayr).
• Fixed: Thumbnail generation paths on Windows (thanks, @skewray);
• Fixed: Improved exif_read_data() handling (thanks, @towndock).
• Fixed: <txp:password_protect> container error (thanks, @rwetzlmayr).
• Fixed: Recursive use of <txp:yield>.
• Fixed: Allow upload of plugins where filename length exceeds PHP_MAXPATHLEN.
• Fixed: Theme import with invalid JSON manifest.
• Fixed: Improved Textile support for IETF BCP 47 language tags.
• Fixed: Plugin compilation output: order, not load_order.
• Fixed: Default public theme CSS should not be minified.
• Added: <txp:file_download_info /> tag.
• Added: 'version' attribute to <txp:css /> tag.
• Added: 'download' attribute to <txp:file_download_link /> tag.
• Added: 'aspect' ratio output to <txp:image_info /> tag.
• Added: Publishers can set password for any user, and choose whether invite link is sent.
• Added: Copy to clipboard feature for Diagnostics and Setup info.
• Added: Dark mode for default public theme.
• Added: Clean URL test user agent ('Textpattern CMS clean URL test').
• Added: Latest text translations. Thank you to all our translators.
• Changed: Modernisation of default public theme CSS rules.
• Changed: Article 'uid' uses Tiger-128,3 hash instead of MD5 hash.
• Changed: Add TEXTPATTERN_DEFAULT_LANG to config.php during setup.
• Performance: Reduced query count if theme textpack is unchanged.
• Developer: Added 'ext' and 'mime' to global $thisfile array.
• Developer: Added 'uid' to global $thisarticle array.
• Developer: Exposed raw_label in UI\InputLabel.
• Vendors: Textile 4.1.6. (thanks, @gocom).
• Vendors: DOMPurify 3.4.17.

Contributors