25.09.3

logto-io/logto25.09.3May 7, 2026by andrewsanchez

AI Summary

This is a critical security release addressing a vulnerability in Anki's local media server that could allow malicious websites to read local files while Anki is running, requiring users to upgrade immediately.

Key Highlights

Security fix for local media server request validation
Vulnerability could allow malicious websites to access local files
Affects Firefox and Safari users; Chrome is already restricted
Credits Tavis Ormandy for reporting the vulnerability

Full Release Notes

## What's Changed
This is a security release. Please upgrade as soon as possible using `Tools > Upgrade/Downgrade`.

Anki's local media server did not sufficiently validate requests, which could allow a malicious website to read local files while Anki was running. This had the potential to affect mostly Firefox and Safari users. Chrome already restricts local network access. Thanks to the great Tavis Ormandy (@taviso) for the report.

All other fixes and new features since 25.09.2 will follow in a separate beta release.

## Installing

- If you're a new user, please grab the latest launcher from https://apps.ankiweb.net
- If you already have the 25.09 launcher, you can use Tools>Upgrade/Downgrade inside Anki.
- If you have an older launcher/Anki, please grab the latest launcher first, as the older one may or may not work.