25.09.4

logto-io/logto25.09.4May 8, 2026by andrewsanchez

AI Summary

This is a critical security release that addresses a vulnerability where importing untrusted decks could potentially read local files. Immediate upgrading is recommended.

Key Highlights

Critical security vulnerability fix for untrusted .apkg files
Immediate upgrade required via Tools > Upgrade/Downgrade
Acknowledgment of security researchers for the report and fix

Full Release Notes

## What's Changed
This is a security release. Please upgrade as soon as possible using `Tools > Upgrade/Downgrade`.

Importing untrusted decks (`.apkg` files) had the ability to read local files. This has now been fixed.

Other fixes and new features will follow in the next beta release.

Many thanks to @Bankde for the excellent report and to @abdnh, @dae, and @fernandolins for the fix! 🙏🏻 

## Installing

- If you're a new user, please grab the latest launcher from https://apps.ankiweb.net
- If you already have the 25.09 launcher, you can use `Tools>Upgrade/Downgrade` inside Anki.
- If you have an older launcher/Anki, please grab the latest launcher first, as the older one may or may not work.