CPalius CMF 2.2.50

Released: 2026-10-12 · Channel: stable · Critical: no

Security filter

Forum posts that mentioned things like .env, wp-login.php or ../ in their text were rejected with a plain "Forbidden" page. The body field is now exempt from the request scan on the forum's new topic, reply, post edit and draft save routes, as it already was in the admin and AACP areas.
Only the body field is exempt there. Titles, URLs and every other route are scanned as before, and the firewall stays on. Forum output is escaped by the forum presenter.

No schema changes. Clear cp-core/var/cache/prod/ after updating, and the Redis cache if you use one.