9.5.4 Release Notes
Behavioral Improvements
Test mail settings: show email sender, add links to configuration pages (#13078) (thanks mlocati)
SEO bulk report no longer rescans paths needlessly for every page it lists. (#13071)
Improve sanitization checking of SVG on upload
Bug Fixes
Fix issue with composer attribute control not saving
When dragging / dropping page in sitemap an "invalid token"-error occurs (#13077)
Rescan Locale strips every content-block page link and crashes on stack pages (#13082) (thanks janscarton)
Mail Service: From and Subject headers are still encoded on the dashboard logs page (9.5.3) (#13075) (thanks broreece)
Express object dashboard: validation failure returns a 500 instead of an error (#13093)
Express object dashboard: delete_entries() has no permission check (#13095)
[Bug] Translate Site Interface “Save to file” fails with “Invalid language identifier” on a non-default site (#13065)
Security Updates
CVE-2026-85385 (Risk Rank 7.7) (thanks Suraj Bhosale)
CVE-2026-85386 (Risk Rank 7.3) (thanks Valentin SARRE (Independent security researcher))
CVE-2026-85387 (thanks Myq Larson)
CVE-2026-87028 (Risk Rank 5.3) (thanks Pakung)
CVE-2026-87031 (Risk Rank 2.1) (thanks Winston Crooker)
Developer
Fix the documented types of the attribute value objects (#13079) (thanks mlocati)
Removed some vestigial code (thanks mlocati)
9.5.3 Release Notes
New Features
Added a Sort by dropdown above the folder tree in the Move to Folder dialog (thanks digitmaster)
The file manager will now reload when a file is moved into another folder (thanks digitmaster)
Improve folder selection in file upload dialogs (#13060) (thanks digitmaster)
If user-configurable time zones are enabled, the timezone field is now shown on user create (thanks broreece)
Multiple new options added to the Generate Thumbnails task (thanks katalysis)
Allow copying API scopes with a single click (#13037) (thanks mlocati)
Show / Hide password option on login form (#12731) (thanks digitmaster)
Add user group membership columns to user search (#13053) (thanks digitmaster)
Behavioral Improvements
Prevent duplicate HTTP requests when selecting a file when using the launch dialog file picker (thanks yyya-nico)
Let theme area classes use a * wildcard and inherit through nested sub-areas (thanks janscarton)
Moving files from one folder to an other (#10586) (thanks digitmaster)
Cleaned up some old CSS and JS asset require statements that did nothing but bloat logs (thanks broreece)
Fixed: Toolbar tooltips remain visible and obscure opened dashboard panels (thanks digitmaster)
Files can now be dragged and dropped directly into an empty File Manager folder without opening the Import Files dialog first (thanks digitmaster)
Package updates now clear the opcache instead of instructing users to do it (thanks mlocati)
Improve and fix keyword search of the file list (#13039) (thanks mlocati)
Export the currently selected columns from the user search (#13054) (thanks digitmaster)
Search preset list is not updated after deleting a preset (#13058) (thanks digitmaster)
Improvements to determining whether Concrete is installed via composer (thanks mlocati)
Bug Fixes
Fixed error where orphaned blocks are impossible to delete under certain conditions (thanks janscarton)
Fix container notch and move control disappearing after a move (thanks janscarton)
Prevent duplicate composer controls from causing a publish hang (thanks iampedropiedade)
Fix TypeError in EditPagePropertiesPageKey causing Sitemap "Internal Server Error” (thanks vmc874)
Fix token error message when a user accidentally submits a login form twice (thanks janscarton)
Fixed: User receives "Website Registration Notification" email twice when deactivated and then activated (thanks broreece)
Fixed: File Manager "Date Added" column crashes when it is chosen as a column in the File Manager (thanks digitmaster)
Fixed Broken client name displayed in OAuth authorization page (thanks mlocati)
Apply 'quoted_printable_decode' function to mail details if content contains quoted-printable characters (thanks broreece)
Fixed error where Dashboard navigation did not refresh when logging in as another user via “Sign in As User” or via custom login methods that did not clear session (thanks digitmaster)
Fixed: PageList public date "Between" filter fails with empty date values (thanks broreece)
Fixed: @theme Twig namespace not resolved for blocks in global areas on dashboard pages
Fixed: Workflow notification emails show the wrong “Version Comment” (next version’s comment is used) (thanks broreece)
Fixed error where Marketplace add-on update can use stale package controller after download (thanks digitmaster)
Fixed: Marketplace add-on download timeout crashes dashboard update flow (thanks digitmaster)
Fixed: Copying a block from a global area fail on multilingual sites (thanks jarpen)
Fixed error where the plain text email for conversation subscription emails would show HTML text incorrectly (thanks broreece)
Fixed: Marketplace package downloads should show actionable package directory errors (thanks digitmaster)
Fixed: Restoring pages from Trash via drag-and-drop broken in 9.5.2 (thanks nratering)
Fixed: HTML block searchable content can include body of <style> or <script> tags
Fixed: Search columns with an unwired getColumnCallback() fatal the entire results page.
Fixed: OpenAPI scopes on area endpoints use plural (…:add_blocks) but OAuth registry use singular (thanks hissy)
Upgrade fails on MariaDB 11.4/MySQL 8.0+: Invalid default value for 'ugEntered' in UserGroups table (#12914)
Bug: Conversations Block endpoints return 500 errors due to missing payload parameters (#13012)
Stack usage not reported correctly (#12531)
Container in package not found when rendering (#11748)
Custom white label background image does not display on the dashboard Welcome page (#11957)
Fixed: Group folders are ignored when generating the gPath value (thanks broreece)
Accordion header level has no effect on formatting (#11930) (thanks digitmaster)
[Page List block] Location filtering does not work correctly if the block is a copy from master collection (#11370) (thanks m3dium)
Calendar Event block - issue with calendar not showing events (#12955) (thanks Roshan931)
Saved search presets allow duplicate (multiple) names (#13056) (thanks digitmaster)
Form does not display errors if it is on the stack (#5941) (thanks broreece)
Security Updates
CVE-2026-68526 (Risk Rank 5.3)
CVE-2026-68531 (Risk Rank 2.1)
CVE-2026-68530 (Risk Rank 2.1)
CVE-2026-68529 (Risk Rank 2.1)
CVE-2026-18421 (Risk Rank 2.1)
CVE-2026-68534 (Risk Rank 2.3)
CVE-2026-18116 (Risk Rank 7.3)
CVE-2026-18119 (Risk Rank 7)
CVE-2026-18112 (Risk Rank 7.7)
CVE-2026-18422 (Risk Rank 2.1)
CVE-2026-18113 (Risk Rank 7.5)
CVE-2026-18117 (Risk Rank 7.3)
CVE-2026-18122 (Risk Rank 6)
CVE-2026-68533 (Risk Rank 2.3)
CVE-2026-18423 (Risk Rank 2.1)
CVE-2026-18424 (Risk Rank 2.1)
CVE-2026-18120 (Risk Rank 6.3)
CVE-2026-18425 (Risk Rank 2.1)
CVE-2026-68527 (Risk Rank 5.9)
CVE-2026-18121 (Risk Rank 6.3)
CVE-2026-68528 (Risk Rank 6)
CVE-2026-18426 (Risk Rank 2)
CVE-2026-68532 (Risk Rank 2.3)
CVE-2026-68535 (Risk Rank 5.1)
CVE-2026-18111 (Risk Rank 8.5)
CVE-2026-18115 (Risk Rank 7.4)
CVE-2026-81905 (Risk Rank 6.3)
CVE-2026-81906 (Risk Rank 6.3)
CVE-2026-81925 (Risk Rank 2.1)
CVE-2026-81912 (Risk Rank 5.7)
CVE-2026-81917 (Risk Rank 5.1)
CVE-2026-81911 (Risk Rank 5.8)
CVE-2026-81920 (Risk Rank 2.3)
CVE-2026-7888 (Risk Rank 7.1)
CVE-2026-18110 (Risk Rank 8.7)
CVE-2026-81908 (Risk Rank 6)
CVE-2026-81921 (Risk Rank 2.3)
CVE-2026-81907 (Risk Rank 6.1)
CVE-2026-81900 (Risk Rank 7.3)
CVE-2026-81899 (Risk Rank 7.3)
CVE-2026-81913 (Risk Rank 5.3)
CVE-2026-81902 (Risk Rank 7.1)
CVE-2026-81910 (Risk Rank 5.9)
CVE-2026-81915 (Risk Rank 5.1)
CVE-2026-81924 (Risk Rank 2.1)
CVE-2026-18118 (Risk Rank 7.3)
CVE-2026-81903 (Risk Rank 7)
CVE-2026-81923 (Risk Rank 2.1)
CVE-2026-81895 (Risk Rank 8.5)
CVE-2026-81927 (Risk Rank 1.8)
CVE-2026-81897 (Risk Rank 7.7)
CVE-2026-81918 (Risk Rank 4.8)
CVE-2026-81919 (Risk Rank 2.3)
CVE-2026-81922 (Risk Rank 2.1)
CVE-2026-81896 (Risk Rank 8.4)
CVE-2026-81894 (Risk Rank 8.5)
CVE-2026-81898 (Risk Rank 7.5)
CVE-2026-81904 (Risk Rank 6.3)
CVE-2026-81909 (Risk Rank 5.9)
CVE-2026-81926 (Risk Rank 2)
CVE-2026-81916 (Risk Rank 5.1)
CVE-2026-81901 (Risk Rank 7.2)
CVE-2026-84432 (Risk Rank 5.3)
Developer
Fix BindingServiceTest with recent Mockery versions (#13038) (thanks mlocati)
Added new REST API endpoint to create (clone) an editable page draft version
Classes that have aliases (usually for legacy purposes) are now properly able to be used as singletons with dependency injection (thanks mlocati)
Update League/Fractal for PHP 8.1 compatibility (thanks mlocati)