https://feeds.craftcms.com/critical.atom2026-02-22T12:55:07+00:00https://feeds.craftcms.com/critical.atom/41051212026-02-22T12:55:07+00:00ByMayo{"type": "url", "value": "http://bymayo.co.uk"}<h3>Fixed</h3> <ul> <li>Open redirect vulnerability in follow/unfollow actions. Redirect parameter is now validated via <code>redirectToPostedUrl()</code>. Could cause a potential phishing attack.</li> <li>Follow and unfollow actions now require authentication and POST requests to prevent CSRF attacks.</li> <li><code>toggle()</code> method having inverted logic (follow when already following, unfollow when not following).</li> <li><code>createFollow()</code> returning <code>true</code> even when the database save failed, and leaving transactions uncommitted.</li> <li><code>deleteFollow()</code> throwing a fatal error on race conditions when the record is already deleted.</li> </ul> <h3>Removed</h3> <ul> <li>Unused <code>FollowService</code> import and stale composer.json component reference.</li> </ul> https://feeds.craftcms.com/critical.atom/41050772026-02-18T11:16:30+00:00Verbb"https://verbb.io/"<h3>Changed</h3> <ul> <li>Updated Summary field AJAX requests to use submission UIDs.</li> </ul> https://feeds.craftcms.com/critical.atom/41050762026-02-18T11:15:49+00:00Verbb"https://verbb.io/"<h3>Changed</h3> <ul> <li>Updated Summary field AJAX requests to use submission UIDs.</li> </ul> https://feeds.craftcms.com/critical.atom/41050712026-02-18T01:57:58+00:00Pixel & Tonic"https://pixelandtonic.com"<ul> <li>Fixed a <a href="proxy.php?url=https://github.com/craftcms/cms/security/policy#severity--remediation">critical-severity</a> information disclosure vulnerability. (GHSA-q6fm-p73f-x862)</li> </ul> https://feeds.craftcms.com/critical.atom/41050332026-02-14T01:41:22+00:00Verbb"https://verbb.io/"<h3>Fixed</h3> <ul> <li>Fix lack of sanitization of File Upload files, where the Upload Location subpath contained variables.</li> </ul> https://feeds.craftcms.com/critical.atom/41050322026-02-14T01:36:19+00:00Verbb"https://verbb.io/"<h3>Fixed</h3> <ul> <li>Fix lack of sanitization of File Upload files, where the Upload Location subpath contained variables.</li> </ul> https://feeds.craftcms.com/critical.atom/41023592025-04-10T22:42:46+00:00Pixel & Tonichttps://pixelandtonic.com<ul> <li>Fixed an RCE vulnerability.</li> </ul> https://feeds.craftcms.com/critical.atom/41023582025-04-10T22:40:44+00:00Pixel & Tonichttps://pixelandtonic.com<ul> <li>Fixed an RCE vulnerability.</li> </ul> https://feeds.craftcms.com/critical.atom/41023572025-04-10T22:37:41+00:00Pixel & Tonichttps://pixelandtonic.com<ul> <li>Fixed an RCE vulnerability.</li> </ul> https://feeds.craftcms.com/critical.atom/41003272024-12-19T18:59:34+00:00Pixel & Tonichttps://pixelandtonic.com<ul> <li>Fixed an RCE vulnerability.</li> </ul> https://feeds.craftcms.com/critical.atom/41001232024-12-11T17:47:50+00:00Joren.co"https://www.joren.co/"<blockquote class="note warning"><p>If you're using a custom login template you'll have to replace <code>action="proxy.php?url={{ craft.app.request.getParam('ref') }}"</code> with <code>action="proxy.php?url={{ craft.templateGuard.loginFormAction() }}"</code>.</p> </blockquote> <ul> <li>The <code>ref</code> query param used on the login page is now protected against tampering.</li> </ul> https://feeds.craftcms.com/critical.atom/40999562024-12-03T15:31:19+00:00Flipbox Digital{"type": "url", "value": "https://www.flipboxdigital.com/"}<h3>Fixed</h3> <ul> <li>SECURITY PATCH - Update REQUIRED! More info can be found here: <a href="proxy.php?url=https://github.com/simplesamlphp/saml2/security/advisories/GHSA-pxm4-r5ph-q2m2#event-375127">https://github.com/simplesamlphp/saml2/security/advisories/GHSA-pxm4-r5ph-q2m2#event-375127</a></li> </ul> https://feeds.craftcms.com/critical.atom/40999552024-12-03T15:22:24+00:00Flipbox Digital{"type": "url", "value": "https://www.flipboxdigital.com/"}<h3>Fixed</h3> <ul> <li>SECURITY PATCH with saml-core/saml2 dependencies. Update REQUIRED! More info can be found here: <a href="proxy.php?url=https://github.com/simplesamlphp/saml2/security/advisories/GHSA-pxm4-r5ph-q2m2#event-375127">https://github.com/simplesamlphp/saml2/security/advisories/GHSA-pxm4-r5ph-q2m2#event-375127</a></li> </ul> https://feeds.craftcms.com/critical.atom/40995892024-11-19T17:17:55+00:00Pixel & Tonichttps://pixelandtonic.com<ul> <li>Fixed an error that could occur if an invalid folder ID was passed to <code>craft\services\Assets::deleteFoldersByIds()</code>. (<a href="proxy.php?url=https://github.com/craftcms/cms/pull/16147">#16147</a>)</li> <li>Fixed a SQL error that occurred when creating a new Single section. (<a href="proxy.php?url=https://github.com/craftcms/cms/issues/16145">#16145</a>)</li> <li>Fixed an error that occurred when running the <code>resave/all</code> command, if any of the options passed weren’t supported by other <code>resave/*</code> commands. (<a href="proxy.php?url=https://github.com/craftcms/cms/pull/16148">#16148</a>)</li> <li>Fixed an error that occurred when restoring a soft-deleted custom field. (<a href="proxy.php?url=https://github.com/craftcms/cms/issues/16150">#16150</a>)</li> <li>Fixed an RCE vulnerability.</li> </ul> https://feeds.craftcms.com/critical.atom/40995882024-11-19T17:16:37+00:00Pixel & Tonichttps://pixelandtonic.com<ul> <li>Fixed an error that could occur if an invalid folder ID was passed to <code>craft\services\Assets::deleteFoldersByIds()</code>. (<a href="proxy.php?url=https://github.com/craftcms/cms/pull/16147">#16147</a>)</li> <li>Fixed an RCE vulnerability.</li> </ul> https://feeds.craftcms.com/critical.atom/41044412026-01-06T19:21:16+00:00PutYourLightsOn"https://putyourlightson.com/"<blockquote class="note warning"><p>This update includes a fix for an issue in which Blitz could send incorrect Cache-Control headers. Please <a href="proxy.php?url=https://putyourlightson.com/articles/critical-update-for-a-blitz-blunder">read this article</a> to find out whether the issue affects your site, and what you should do. To ensure the changes in this update are applied, the cache should be refreshed after this update completes.</p> </blockquote> <h3>Added</h3> <ul> <li>Added a check for whether the cache should be refreshed after every request has ended, meaning that setting the <code>RefreshCacheService::batchMode</code> property no longer serves a purposes and can be safely removed.</li> <li>Added compatibility with Craft 5.3.0 for detecting eager-loading opportunities in the Blitz Hints utility.</li> </ul> <h3>Changed</h3> <ul> <li>The expiry date displayed in the element sidebar panel now reflects the entry’s expiry date, if set and sooner than the cached page’s expiry date (<a href="proxy.php?url=https://github.com/putyourlightson/craft-blitz/issues/698">#698</a>).</li> <li>The <code>refreshCacheEnabled</code> config setting is now actually respected.</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed the default cache control header values that were inadvertently set to incorrect values (<a href="proxy.php?url=https://putyourlightson.com/articles/critical-update-for-a-blitz-blunder">learn more</a>).</li> <li>Fixed the nested element type count displayed in the Blitz Diagnostics utility.</li> <li>Fixed a bug in which the date cached and expiry dates were not being displayed in the correct timezone in the element sidebar panel (<a href="proxy.php?url=https://github.com/putyourlightson/craft-blitz/issues/698">#698</a>).</li> <li>Fixed a bug in which the homepage was not being displayed as cached in the element sidebar panel.</li> <li>Fixed a bug that was causing integrity constraint violation errors to be logged (<a href="proxy.php?url=https://github.com/putyourlightson/craft-blitz/issues/699">#699</a>).</li> </ul> <h3>Deprecated</h3> <ul> <li>Deprecated the <code>RefreshCacheService::batchMode</code> property.</li> </ul> https://feeds.craftcms.com/critical.atom/41044842026-01-06T19:22:57+00:00PutYourLightsOn"https://putyourlightson.com/"<blockquote class="note warning"><p>This update includes a fix for an issue in which Blitz could send incorrect Cache-Control headers. Please <a href="proxy.php?url=https://putyourlightson.com/articles/critical-update-for-a-blitz-blunder">read this article</a> to find out whether the issue affects your site, and what you should do. To ensure the changes in this update are applied, the cache should be refreshed after this update completes.</p> </blockquote> <h3>Added</h3> <ul> <li>Added a check for whether the cache should be refreshed after every request has ended, meaning that setting the <code>RefreshCacheService::batchMode</code> property no longer serves a purposes and can be safely removed from your code.</li> </ul> <h3>Changed</h3> <ul> <li>Blitz now requires Craft CMS 4.5.11 or later.</li> <li>The expiry date displayed in the element sidebar panel now reflects the entry’s expiry date, if set and sooner than the cached page’s expiry date (<a href="proxy.php?url=https://github.com/putyourlightson/craft-blitz/issues/698">#698</a>).</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed the default cache control header values that were inadvertently set to incorrect values (<a href="proxy.php?url=https://putyourlightson.com/articles/critical-update-for-a-blitz-blunder">learn more</a>).</li> <li>Fixed a bug in which the date cached and expiry dates were not being displayed in the correct timezone in the element sidebar panel (<a href="proxy.php?url=https://github.com/putyourlightson/craft-blitz/issues/698">#698</a>).</li> <li>Fixed a bug in which the homepage was not being displayed as cached in the element sidebar panel.</li> </ul> <h3>Deprecated</h3> <ul> <li>Deprecated the <code>RefreshCacheService::batchMode</code> property.</li> </ul> https://feeds.craftcms.com/critical.atom/40968032024-08-19T17:12:45+00:00Studio Espresso"https://www.studioespresso.co"<h3>Fixed</h3> <ul> <li>Fixed an bug where exports would be deteled when the system ran Garbage Collection. You'll have to update to this version and recreate your exports.</li> </ul> https://feeds.craftcms.com/critical.atom/40957512024-07-10T09:47:10+00:00Ether Creative"https://ethercreative.co.uk"<h3>Security</h3> <ul><li>Removed Polyfill.io (<a href="proxy.php?url=https://sansec.io/research/polyfill-supply-chain-attack">https://sansec.io/research/polyfill-supply-chain-attack</a>)</li> </ul>https://feeds.craftcms.com/critical.atom/40955132024-06-27T15:07:33+00:00Pixel & Tonic"https://pixelandtonic.com"<ul> <li>Added <code>craft\commerce\paypalcheckout\gateways\Gateway::showPaymentFormSubmitButton()</code>.</li> <li>Fixed a supply chain security vulnerability.</li> </ul>