CPalius CMF 2.2.49

Released: 2026-10-12 · Channel: stable · Critical: no

Malware scanner

The scanner no longer flags itself. Its rule file used to contain the web shell names it searches for, so a full-scope scan reported its own rules as a "known web shell". The names are now assembled from pieces.
In the shipped core code (cp-core/src, config, templates, install) the weak "uses a shell function / eval" hints are skipped, so legitimate code such as the cache rebuilder's background process launcher is not listed as a finding. Strong rules still apply there; uploads and module/theme packages are always checked in full.

The description field of an entry is now a rich text editor (CKEditor).
Save and Cancel moved to the very bottom of the entry page, below the gallery, links and moderation cards.

No schema changes. Clear cp-core/var/cache/prod/ after updating, and the Redis cache if you use one.