Skip to content

DOC Update CMS 6.3 changelogs #901

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
blueo merged 1 commit into from
Aug 31, 2026
Merged

DOC Update CMS 6.3 changelogs #901

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 2 additions & 8 deletions en/08_Changelogs/6.3.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,7 @@ title: 6.3.0 (unreleased)

## Security considerations {#security-considerations}

This release includes several security fixes. Review the vulnerability disclosures below for more detailed descriptions of each security fix. We highly encourage upgrading your project to include the latest security patches.

We have provided a severity rating of each vulnerability below based on its CVSS score. The impact of each vulnerability could vary based on the specifics of each project. You can [read the severity rating definitions](/contributing/release_process/#severity-rating) in the Silverstripe CMS release process.
The following fixes were previously released as patches for earlier release lines:
Comment thread
blueo marked this conversation as resolved.

- [CVE-2026-54721 Remote code execution via userforms email subject](https://www.silverstripe.org/download/security-releases/cve-2026-54721) Severity: High
- [CVE-2026-54718 Remote code execution via advanced workflow email template](https://www.silverstripe.org/download/security-releases/cve-2026-54718) Severity: High
Expand All @@ -33,7 +31,7 @@ We have provided a severity rating of each vulnerability below based on its CVSS

The root-cause fix for both remote code execution vulnerabilities lives in the template parser, which now emits single-quoted PHP string literals for `<%t %>` translation blocks so that variables and expressions are no longer interpolated.

The high severity fixes have also been released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes have been released in a patch for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution.
The high severity fixes were released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes were released in patches for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution.

### Action may be required for media embeds {#media-embed-sandboxing}

Expand Down Expand Up @@ -78,10 +76,6 @@ Extension hooks are called either side of each write the editor makes, so you ca

See [image editor](/developer_guides/customising_the_admin_interface/image_editor/) for the rest of the configuration options.

### Other new features and enhancements {#other-new}
Comment thread
blueo marked this conversation as resolved.

No other new features or enhancements have been documented yet for this release.

### React class components converted to functional components {#react-functional-components}

Form field components in the CMS have been converted from React class components to functional components. This is part of an ongoing modernisation effort - functional components are simpler, have better tooling support, and align with current React best practices.
Expand Down
8 changes: 2 additions & 6 deletions en/08_Changelogs/beta/6.3.0-beta1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ The following fixes were previously released as patches for earlier release line

The root-cause fix for both remote code execution vulnerabilities lives in the template parser, which now emits single-quoted PHP string literals for `<%t %>` translation blocks so that variables and expressions are no longer interpolated.

The high severity fixes have also been released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes have been released in a patch for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution.
The high severity fixes were released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes were released in patches for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution.

### Action may be required for media embeds {#media-embed-sandboxing}

Expand All @@ -102,7 +102,7 @@ Content authors can now make simple composition changes to images without leavin

In the "Files" section, click an image to open its detail view, then click the "Other actions" button - the three dots next to "Save" and "Publish" - and select "Edit image". The action only appears for raster images you have permission to edit.

![Image editor](../_images/image-editor.png)
![Image editor](../../_images/image-editor.png)

@emteknetnz emteknetnz Aug 31, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The image shows correctly in the 6.3.0.md changelog, but because the beta changelog is nested an extra level up with need to traverse to one extra parent dir


The editor is focused on image composition (where the subject sits in the frame) rather than retouching i.e. there are no brightness, colour, filter, or background removal controls.

Expand All @@ -122,10 +122,6 @@ Extension hooks are called either side of each write the editor makes, so you ca

See [image editor](/developer_guides/customising_the_admin_interface/image_editor/) for the rest of the configuration options.

### Other new features and enhancements {#other-new}

No other new features or enhancements have been documented yet for this release.

### React class components converted to functional components {#react-functional-components}

Form field components in the CMS have been converted from React class components to functional components. This is part of an ongoing modernisation effort - functional components are simpler, have better tooling support, and align with current React best practices.
Expand Down
Loading