New version 9.5.9
This release fixes several critical security issues that has been recently discovered. Update is strongly recommended!
Security fixes:
2022-35945 : XSS through registration API
2022-31143 : Leak of sensitive information through login page error
2022-35914 : [critical] Command injection using a third-party library script
2022-35946 : SQL injection through plugin controller
2022-35947 : [critical] Authentication via SQL injection
2022-36112 : Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning

New version 9.5.8
This is a security release, upgrading is recommended
Security fixes:
2022-31061 : SQL injection on login page
2022-24868 : XSS / open redirect via SVG file upload
2022-24869 : Cross Site CSS Injection

New version 9.5.7
This is a security release, upgrading is recommended
Security fixes:
2022-21720 : SQL injection using custom CSS administration form
2022-21719 : Reflected XSS using reload button

New version 9.5.6
This is a security release, upgrading is recommended
Security fixes:
2021-39211 : Disclosure of GLPI and server informations in telemetry endpoint
2021-39210 : Autologin cookie accessible by scripts
2021-39209 : Bypassable CSRF protection on ajax endpoints
2021-39213 : Bypassable IP restriction on GLPI API using custom header injection

New version 9.5.5
This is a security release, upgrading is recommended
Security fixes:
2021-3486 : Stored XSS in plugins information

New version 9.5.4
This is a security release, upgrading is recommended
Security fixes:
2021-21326 : Horizontal Privilege Escalation
2021-21255 : entities switch IDOR
2021-21258 : XSS injection in ajax/kanban
2021-21314 : XSS injection on ticket update
2021-21312 : Stored XSS on documents
2021-21313 : XSS on tabs
2021-21325 : Stored XSS in budget type
2021-21327 : Unsafe Reflection in getItemForItemtype()
2021-21324 : Insecure Direct Object Reference (IDOR) on "Solutions"

New version 9.5.3
This is a security release, upgrading is recommended
Security fixes:
2020-27662 : Insecure Direct Object Reference on ajax/comments.php
2020-27663 : Insecure Direct Object Reference on ajax/getDropdownValue.php
2020-26212 : Any CalDAV calendars is read-only for every authenticated user

Changed PHP7 dependencies

Fixed spec

New version 9.5.2
Security fixes:
2020-15176 : SQL injection with a query parameter of user form
2020-15175 : Removal of .htaccess file in the files folder via a plugin endpoint
2020-15217 : Leakage issue with knowledge base
2020-15177 : Stored XSS in install script
2020-15226 : Minor SQL Injection in Search API

New version 9.5.1

New version 9.4.6
This is a security release, upgrading is highly recommended

New version 9.4.5

New version 9.4.4
This is a security release, upgrading is highly recommended

New version 9.4.3
This is a security release, upgrading is highly recommended

New version 9.4.2
This is a security release, upgrading is highly recommended