SysManager 1.52.91

What's new for you

A security hardening: the Windows Features tool now launches PowerShell only from its trusted system location, closing a gap where — if you ran SysManager from a folder someone else could write to — a malicious file placed next to it could have run with your privileges. No change to how the feature behaves for you.

---

[1.52.91] - 2026-07-11

Fixed

• WindowsFeaturesService launched PowerShell by the extension-less name "powershell", defeating the System32 path-pinning that blocks binary-planting privilege escalation on an elevated code path. All three call sites (ListFeaturesAsync, EnableFeatureAsync, DisableFeatureAsync — the enable/disable paths run elevated) called RunProcessAsync("powershell", …). PowerShellRunner hardens the target via SystemPaths.ResolveSystemTool, but that helper resolved by File.Exists and only ever probed the bare name — File.Exists(@"…\System32\WindowsPowerShell\v1.0\powershell") is false (the file is powershell.exe), so both probes missed and it returned the unrooted "powershell". With UseShellExecute=false, Win32 CreateProcess then searches the calling process's own directory first — so an attacker-planted powershell.exe next to SysManager's portable .exe (often run from a user-writable folder, sometimes elevated) would execute with the app's privileges. Changed all three sites to "powershell.exe" (matching PowerShellRunner.RunScriptViaPwshAsync and every other system-tool caller, which all use the .exe suffix). Fix-the-class: SystemPaths.ResolveSystemTool now also probes "<name>.exe" when given an extension-less bare name, so a future caller that forgets the suffix can't silently reopen the same hole.

---

Verify the download

Get-FileHash .\SysManager-v1.52.91.exe -Algorithm SHA256

Expected SHA256: E4DD9BD3875EABEF51BD12537F7A560AEFA91B5E73306E6FF442A5840B4E9068