Download Latest Version textpattern-4.9.2.zip (4.1 MB)
Home / 4.9.2
Name Modified Size InfoDownloads / Week
Parent folder
textpattern-4.9.2.zip.SHA256SUM 2026-11-01 88 Bytes
0
textpattern-4.9.2.tar.xz.SHA256SUM 2026-11-01 91 Bytes
0
textpattern-4.9.2.zip 2026-11-01 4.1 MB
0
textpattern-4.9.2.tar.gz.SHA256SUM 2026-11-01 91 Bytes
0
textpattern-4.9.2.tar.xz 2026-11-01 2.4 MB
0
textpattern-4.9.2.tar.gz 2026-11-01 3.8 MB
0
README.md 2026-11-01 2.8 kB
0
v4.9.2 source code.tar.gz 2026-11-01 3.8 MB
0
v4.9.2 source code.zip 2026-11-01 4.2 MB
0
Totals: 9 Items   18.4 MB 0
  • Maintenance release with security enhancements, general improvements and bug fixes.
  • Security: Resolved skipping of authentication for concurrent logins via cookie (thanks, @moltengama and @Groppoxx).
  • Security: Always sandbox preview frames and introduce admin-side CSP layer (thanks, Nguyen Trung Hoang).
  • Security: Sanitize 'sort' attribute of <txp:authors> tag (thanks, Neder).
  • Security: Sanitize 'sort' attribute of <txp:file_download> tag (thanks, @moltengama and @Groppoxx).
  • Security: Sanitize 'url_title' attribute consistently (thanks, @moltengama and @Groppoxx).
  • Security: CSP improvements to mitigate user privilege CSRF (thanks, @AnhNg1410).
  • Security: Theme import is now CSRF-aware (thanks, @fy0lai)).
  • Security: Validate administrative user status on Users panel updates (thanks, @mansurmavlankulov).
  • Security: Resolve sanitization of file paths in XML-RPC mt_uploadImage() (thanks, zsm-cry). Refer to CVE-2026-5344 for additional information.
  • Fixed: FROM_UNIXTIME(0) timestamp handling on some MySQL/MariaDB versions.
  • Fixed: Deleting image(s) deletes corresponding thumbnails (thanks, @rwetzlmayr).
  • Fixed: Thumbnail generation paths on Windows (thanks, @skewray);
  • Fixed: Improved exif_read_data() handling (thanks, @towndock).
  • Fixed: <txp:password_protect> container error (thanks, @rwetzlmayr).
  • Fixed: Recursive use of <txp:yield>.
  • Fixed: Allow upload of plugins where filename length exceeds PHP_MAXPATHLEN.
  • Fixed: Theme import with invalid JSON manifest.
  • Fixed: Improved Textile support for IETF BCP 47 language tags.
  • Fixed: Plugin compilation output: order, not load_order.
  • Fixed: Default public theme CSS should not be minified.
  • Added: <txp:file_download_info /> tag.
  • Added: 'version' attribute to <txp:css /> tag.
  • Added: 'download' attribute to <txp:file_download_link /> tag.
  • Added: 'aspect' ratio output to <txp:image_info /> tag.
  • Added: Publishers can set password for any user, and choose whether invite link is sent.
  • Added: Copy to clipboard feature for Diagnostics and Setup info.
  • Added: Dark mode for default public theme.
  • Added: Clean URL test user agent ('Textpattern CMS clean URL test').
  • Added: Latest text translations. Thank you to all our translators.
  • Changed: Modernisation of default public theme CSS rules.
  • Changed: Article 'uid' uses Tiger-128,3 hash instead of MD5 hash.
  • Changed: Add TEXTPATTERN_DEFAULT_LANG to config.php during setup.
  • Performance: Reduced query count if theme textpack is unchanged.
  • Developer: Added 'ext' and 'mime' to global $thisfile array.
  • Developer: Added 'uid' to global $thisarticle array.
  • Developer: Exposed raw_label in UI\InputLabel.
  • Vendors: Textile 4.1.6. (thanks, @gocom).
  • Vendors: DOMPurify 3.4.17.
Source: README.md, updated 2026-11-01