1.0.8.6

ShenhanQian/GaussianAvatars1.0.8.6Jun 11, 2026by givanz

AI Summary

This release addresses critical security vulnerabilities regarding private IP redirection and HTML sanitization, along with updates to the admin template and page builder UI.

Key Highlights

Fixed private IP redirect and IPv6 bypass vulnerabilities
Fixed HTML sanitization for 'on' attributes
Added recursive filtering for file names
Updated admin template and page builder UI

New Features

Security patches for IP redirection and sanitization
Recursive filtering for file names
Admin template update
Page builder UI changes
Translation error fixes

Full Release Notes

* Use curl resolve to avoid private ip redirect and IPv6 bypass, vulnerability reported by @EvidentObscurity https://github.com/givanz/Vvveb/commit/e27d1ef097a8502c33f8cc94271c948407c5dce3
* Admin template update, page builder UI changes https://github.com/givanz/Vvveb/commit/a4882d42411466ea90b6612933b5d1f70fa7cc83
* Plugins update https://github.com/givanz/Vvveb/commit/513db6d716410d75bed99436bf5ed10384cca100
* Translations edit show server message on error, fixed tree list expand arrow button click https://github.com/givanz/Vvveb/commit/6bc8390957256dd831691f352e8c472fb3c91374
* Fixed sanitizeHTML( 'on' attributes sanitization when attribute has '>', vulnerability reported by @EvidentObscurity https://github.com/givanz/Vvveb/commit/c466e618ad1b94916f56062b7732edb5a336f57d
* Added recursive filtering sanitizeFileName(, vulnerability reported by @EvidentObscurity https://github.com/givanz/Vvveb/commit/8c062a047a66d6f04307f8d0e37c34f709a201a9