Fixed
- Adjust Message-ID for outgoing emails to minimize matching by Apache SpamAssassin patterns (#5245)
- Show errors on Status page when shell_exec() funciton can not be executed (#5250)
- Reduced
CcandBccin languages where the text does not fit nicely (#5247) - Do not show
CcandBccfields by default when replying (#5247) - Fixed incomplete object error on Status page (#5246)
- Check access to mailbox when emptying a folder.
- Improved sanitizing uploaded PDF files.
- Fixed permissions check when Following/Unfollowing conversation (Security)
- Fixed in dependency: Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass (Security: CVE-2025-64500)
- Fixed in dependency: PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling (Security: CVE-2026-24765)
- Fixed in dependency: Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows (Security: CVE-2026-25129)
- Fixed in dependency: PsySH has Local Privilege Escalation via CWD .psysh.php auto-load (Security: CVE-2026-24739)
Changed
- Set
APP_CURL_SSL_VERIFYPEERparameter to true by default.