diff --git a/en/08_Changelogs/6.3.0.md b/en/08_Changelogs/6.3.0.md index 640a4780..b247161f 100644 --- a/en/08_Changelogs/6.3.0.md +++ b/en/08_Changelogs/6.3.0.md @@ -21,9 +21,7 @@ title: 6.3.0 (unreleased) ## Security considerations {#security-considerations} -This release includes several security fixes. Review the vulnerability disclosures below for more detailed descriptions of each security fix. We highly encourage upgrading your project to include the latest security patches. - -We have provided a severity rating of each vulnerability below based on its CVSS score. The impact of each vulnerability could vary based on the specifics of each project. You can [read the severity rating definitions](/contributing/release_process/#severity-rating) in the Silverstripe CMS release process. +The following fixes were previously released as patches for earlier release lines: - [CVE-2026-54721 Remote code execution via userforms email subject](https://www.silverstripe.org/download/security-releases/cve-2026-54721) Severity: High - [CVE-2026-54718 Remote code execution via advanced workflow email template](https://www.silverstripe.org/download/security-releases/cve-2026-54718) Severity: High @@ -33,7 +31,7 @@ We have provided a severity rating of each vulnerability below based on its CVSS The root-cause fix for both remote code execution vulnerabilities lives in the template parser, which now emits single-quoted PHP string literals for `<%t %>` translation blocks so that variables and expressions are no longer interpolated. -The high severity fixes have also been released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes have been released in a patch for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution. +The high severity fixes were released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes were released in patches for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution. ### Action may be required for media embeds {#media-embed-sandboxing} @@ -78,10 +76,6 @@ Extension hooks are called either side of each write the editor makes, so you ca See [image editor](/developer_guides/customising_the_admin_interface/image_editor/) for the rest of the configuration options. -### Other new features and enhancements {#other-new} - -No other new features or enhancements have been documented yet for this release. - ### React class components converted to functional components {#react-functional-components} Form field components in the CMS have been converted from React class components to functional components. This is part of an ongoing modernisation effort - functional components are simpler, have better tooling support, and align with current React best practices. diff --git a/en/08_Changelogs/beta/6.3.0-beta1.md b/en/08_Changelogs/beta/6.3.0-beta1.md index 17617660..d5e725fc 100644 --- a/en/08_Changelogs/beta/6.3.0-beta1.md +++ b/en/08_Changelogs/beta/6.3.0-beta1.md @@ -77,7 +77,7 @@ The following fixes were previously released as patches for earlier release line The root-cause fix for both remote code execution vulnerabilities lives in the template parser, which now emits single-quoted PHP string literals for `<%t %>` translation blocks so that variables and expressions are no longer interpolated. -The high severity fixes have also been released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes have been released in a patch for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution. +The high severity fixes were released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes were released in patches for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution. ### Action may be required for media embeds {#media-embed-sandboxing} @@ -102,7 +102,7 @@ Content authors can now make simple composition changes to images without leavin In the "Files" section, click an image to open its detail view, then click the "Other actions" button - the three dots next to "Save" and "Publish" - and select "Edit image". The action only appears for raster images you have permission to edit. -![Image editor](../_images/image-editor.png) +![Image editor](../../_images/image-editor.png) The editor is focused on image composition (where the subject sits in the frame) rather than retouching i.e. there are no brightness, colour, filter, or background removal controls. @@ -122,10 +122,6 @@ Extension hooks are called either side of each write the editor makes, so you ca See [image editor](/developer_guides/customising_the_admin_interface/image_editor/) for the rest of the configuration options. -### Other new features and enhancements {#other-new} - -No other new features or enhancements have been documented yet for this release. - ### React class components converted to functional components {#react-functional-components} Form field components in the CMS have been converted from React class components to functional components. This is part of an ongoing modernisation effort - functional components are simpler, have better tooling support, and align with current React best practices.