Skip to content

Kaleta 3.3.2 (security)

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Oct 19:52
· 581 commits to main since this release
v3.3.2
8521b12

Kaleta 3.3.2 is a security release. It fixes what our audit of 6 October 2026 found. Installations update to it by themselves, and administrators get an e-mail. Please update any site where automatic updates are switched off.

Important fixes

  • Imported content: imported content can no longer carry script onto the site. This covers WordPress, Ghost, Blogger, Joomla, Drupal, Webflow and the import of any website.
    • The sanitizers now escape attribute values completely.
    • Images and attributes are rewritten on the parsed document instead of with text replacements.
    • Imported HTML is cleaned once more just before it is stored.
  • Builder: editors can no longer take over the attributes the site's own scripts read.
    • The element's own attributes now come first.
    • The map, the enquiry basket and the comparison only accept safe addresses.
  • Facts used as links: when a fact is used as a link, its value is now checked like any other link.
  • Add-on tokens: these are filled only in content written in the administration.

More fixes

  • Claude (MCP): a Claude connection can no longer set Google Tag Manager or Matomo. Set them in the administration under Analytics. GA4 and Plausible stay available to Claude.
  • Whistleblowing:
    • The channel limits how many reports arrive per hour and per day.
    • It checks the CAPTCHA when the site has one.
    • It caps total attachment storage.
    • It keeps only an unlinkable, day-salted trace of addresses, for one day.
  • Personal data:
    • Erasing a person's data also clears it from Claude's undo history.
    • Enquiries and similar personal data are no longer kept there.
  • Website importer: pages are always converted with editor rights, never into Custom HTML.
    • The old site's own videos, audio players and inline SVG are reported as omitted.
    • YouTube and Vimeo players are still converted.
  • A Kaleta site export: importing one cleans page and news HTML.

Hardening

  • Claude's guardrails:
    • They protect pages reliably.
    • With "no deleting", deleting redirects and header variants, restoring old versions and sending testimonial requests are refused too.
  • Page passwords: guessing is limited per network and per page.
  • The extensions/ folder: it is no longer reachable from the web, except its public/ subfolders.
    • If you customised your .htaccess: the update keeps your file and saves the new rules as .htaccess.kaleta-nova. Copy them in; System status reminds you.
  • The fleet console: it talks only to public addresses, follows no redirects and limits the size of answers.
  • Add-on tools for Claude: by default, a write tool needs an editor and a deleting tool needs an administrator. Add-ons can set this themselves.
  • Updates: an update installs only the version and kind the site expected.
  • Other admin fixes:
    • Only administrators can renew the tokens for the hosting's scheduled jobs and the uptime monitoring, and only on System status.
    • Changing categories needs publishing rights.
    • Users without the News section see only published news through Claude.
    • The cookie policy address must be a site path or an https address.
    • A correct password no longer resets the count of failed two-factor codes.
    • An OAuth error before consent shows an error page instead of redirecting.
    • Imports do not resend credentials over plain http.

Updating

Sites update by themselves. You can also update from Settings → Backups and updates. Nothing in the database changes.

Assets 4
Loading