Differences

This shows you the differences between two versions of the page.

--- start [2026/06/01 00:58] – psftpteam
+++ start [2026/08/24 08:04] (current) – psftpteam
@@ Line 4: / Line 4: @@
 ===== Changes / Release =====
+==== Version 5.6.4 (08/24/2026) ====
+  * Added FTP / FTPS (FTP over TLS) support to the built-in file transfer service
+  * Upgrade to Apache Mina 2.2.9 fixing five published vulnerabilities:
+    * CVE-2024-52046 - Unsafe deserialization in IoBuffer.getObject(): the class name allowlist was applied too late, potentially allowing remote code execution through crafted serialized data
+    * CVE-2026-41409 - Incomplete fix for CVE-2024-52046: the deserialization allowlist could still be bypassed when a static initializer ran during class resolution
+    * CVE-2026-41635 - A code path in resolveClass() did not enforce the class name allowlist at all, allowing arbitrary code execution via crafted input
+    * CVE-2026-42778 / CVE-2026-42779 - The fixes for CVE-2026-41409 and CVE-2026-41635 were not backported to the 2.1.x / 2.2.x maintenance branches; they are included in version 2.2.9
 ==== Version 5.6.3 (05/31/2026) ====
   * Added Data Protection API / Keyring
   * Optimized SFTP Transport Layer
   * Added SCP Server from Server form
-  * Minor Security Fixes
+  * Code refactoring and Minor Security Fixes
+  * Dependencies optimizations which results to reduced bundle size