Axigen 10.6.26

SECURITY

• Fix data exfiltration scenario based on "video" element with "poster" attribute (AXI-6922)
• Fix JavaScript injection via the timeFormat account preference (AXI-6925 • CVE-2025-68643)
• Sanitize all webmailData fields to prevent JavaScript injection vulnerabilities (AXI-6930)
• Add base-uri and form-action CSP directives (AXI-6933)
• Add CSP headers to the print pages (AXI-6946)
• WebAdmin: Fix incorrect delegated admin access control checks when handling SSL certificates (AXI-6935 • CVE-2025-68721)
• WebAdmin: Fix multiple instances of stored XSS vulnerabilities (AXI-6936 • CVE-2025-68723)
• WebAdmin: Fix application manipulation via malicious links that abuse the breadcrumb parameter (AXI-6937 • CVE-2025-68722)

SERVER

• Fix domain loading order in specific scenarios (AXI-6745)
• Fix administrative permission (AACL) affecting delegated admin access to the FTP backup CLI context (AXI-6889)

WEBADMIN

• Fix account number overlapping the account name column when listing more than 10k accounts (AXI-6681)
• Onboarding: Update license registration text (AXI-6942)

WEBMAIL

• Fix the domain names shown in the domain selection list in the login page (AXI-6715)
• Fix print pages missing base stylesheet in light mode (AXI-6947)

OTHER

• Axigen TNEF filter
  • Fix failsafe recovery validation for the AFSL TNEF filter (AXI-6929)