Kaleta 3.3.3 (security)

Kaleta 3.3.3 is a security release. It fixes what our audit of 7 October 2026 found in 3.3.2. Installations update to it by themselves, and administrators get an e-mail.

Important fixes

• Facts used as links: a fact can no longer become a javascript: link.
  • Facts are now filled into links tag by tag, the way a browser reads the page, and the whole filled address is checked.
  • A text fact cannot be saved when it starts with a script scheme.
• Requests to other servers: these include images, imports, link checks and the fleet console.
  • All of them now go through one shared check. It normalises international and encoded host names, allows only public addresses (also IPv6 and NAT64), and makes sure the connection goes to the checked address.
• Sign-in: a locked, blocked or wrong sign-in now always gets the same answer.
  • Before, a locked account told an attacker when the password was right.
  • Behind Cloudflare and on IPv6, attempts are counted per real visitor and per network.
• The whistleblowing channel: the reporting page no longer loads any third-party CAPTCHA script. That script could reveal reporters to the provider. The limits from 3.3.2 stay.

More fixes

• Account changes: changing your e-mail or adding a passkey now needs your current password. The old address is told when the e-mail changes.
• Sessions: a session ends after 8 hours without activity, or after 24 hours in total. Claude's connections are not affected.
• The password reset:
  • The reset e-mail is sent after the page answers, so the timing doesn't reveal which accounts exist.
  • Passwords are read exactly as typed. Passwords saved before still work.
• Whistleblowing limits:
  • When many reports arrive at once, they are accepted and marked for the readers instead of being refused.
  • Over the storage limit, a report is accepted without its attachments.
• Page passwords: the right password always opens a protected page, even after many wrong attempts from elsewhere.
• Imports:
  • Importing a Kaleta site checks its settings like the administration does.
  • Content imported before 3.3.2 is checked again with today's rules. The check runs during the update and finishes in the background, and System status shows its progress.
• The extensions/ folder: it also refuses .pht and .phps files.

Updating

Sites update by themselves. You can also update from Settings → Backups and updates. The update adds one column for the whistleblowing channel and runs the content check described above.