Team Textpattern is pleased to announce the release of Textpattern 4.9.2, available for immediate download.
Release overview
Textpattern 4.9.2 is a patch release with security fixes, along with refinements & enhancements to functionality, and sundry bug fixes.
Security issues were reported by third-party researchers and addressed by the Textpattern development team. We are grateful to all researchers for their considerations in responsible reporting and co-ordinated disclosure. This article will be updated with relevant CVE assignments as we are informed.
If you operate a Textpattern-powered website, we recommend upgrading to Textpattern 4.9.2. Unless stated, Versions of Textpattern prior to 4.9.2 are affected by the following issues.
Security: Concurrent login authentication checks
Many thanks to ‘MoltenGamaLC’ and ‘Maizeravla’ for responsibly reporting an authentication issue regarding concurrent logins and cookies. We are grateful for their clear and thorough report in outlining the issue which allowed Textpattern developers to reproduce the issue, isolate a fix, and resolve the reported issue.
Security: Sandbox preview frames; Admin-side CSP layer
Many thanks to Hoàng Nguyễn Trung for responsibly reporting an issue regarding content sandboxing. We are grateful for their clear and thorough report in outlining the issue which allowed Textpattern developers to reproduce the issue, consider options to resolve it without affecting functionality, isolate a fix, and address the reported issue.
Security: Sanitize ‘sort’ attribute of authors tag
Many thanks to ‘Neder’ for responsibly reporting an issue regarding the ‘sort’ attribute and its use in the authors tag. We are grateful for their clear and thorough report in outlining the issue which allowed Textpattern developers to reproduce the issue, isolate a fix, and resolve the reported issue.
Security: Sanitize ‘sort’ attribute of file_download tag
Many thanks to ‘MoltenGamaLC’ and ‘Maizeravla’ for responsibly reporting an issue regarding the ‘sort’ attribute and its use in the file_download tag. We are grateful for their clear and thorough report in outlining the issue which allowed Textpattern developers to reproduce the issue, isolate a fix, and resolve the reported issue.
Security: Sanitize ‘url_title’ attribute consistently
Many thanks to ‘MoltenGamaLC’ and ‘Maizeravla’ for responsibly reporting an issue regarding the consistency of ‘url_title’ attribute. We are grateful for their clear and thorough report in outlining the issue which allowed Textpattern developers to reproduce the issue, isolate a fix, and resolve the reported issue.
Security: Mitigate user privilege CSRF with CSP
Many thanks to ‘AnhNg1410’ for responsibly reporting an issue regarding user privilege escalation. We are grateful for their clear and thorough report in outlining the issue which allowed Textpattern developers to reproduce the issue, consider options to resolve it without affecting functionality, isolate a fix, and address the reported issue.
Security: CSRF in theme import workflow
Many thanks to ‘Dalai Sage’, aka ‘fy0lai’ for responsibly reporting a cross-site request forgery(CSRF) issue relating to front-side theme import. We are grateful for their clear and thorough report in outlining the issue, which allowed Textpattern developers to efficiently reproduce the issue, isolate a fix and resolve it.
Security: Validate administrative user status on Users panel
Many thanks to ‘mansurmavlankulov’ for responsibly reporting an issue relating to administrative rights on the Users panel. We are grateful for their clear and thorough report in outlining the issue, which allowed Textpattern developers to efficiently reproduce the issue, isolate a fix and resolve it.
Security: Arbitrary file write with XML-RPC
Many thanks to ‘zsm-cry’ for responsibly reporting an arbitrary file write condition with XML-RPC. We are grateful for their clear and thorough report in outlining the issue, which allowed Textpattern developers to efficiently reproduce the issue, isolate a fix and resolve it. For further details, please refer to CVE-2026-5344.
Upgrading Textpattern
As with all Textpattern upgrades, please refer to the current Textpattern system requirements and ensure you have known-good backups of your site files and database, including all uploaded content such as images & files. Before you make any changes, please refer to the accompanying release notes in HISTORY.txt to ensure you understand what has changed in this release, along with any prior releases that may have been skipped. You can find your current Textpattern version from the bottom of any page on the admin-side.
Thank you to everyone who contributed to this and prior Textpattern releases with reporting & resolving bugs, providing & improving language translations and overall improvements to the Textpattern ecosystem. We’re grateful to all contributors offering us their expertise, time, attention, words, donations, signal boosting, evangelism, cheerleading and all other activities that fuel our project.
Textpattern’s infrastructure and continued development is kindly supported by 1Password and BrowserStack. We are grateful for their ongoing involvement & support for Textpattern, and our global community of authors, publishers, designers and administrators. Thank you!
We work hard to keep Textpattern fast, nimble, secure and ready for pretty much anything you can throw at it. There is no spyware, adware, user tracking or other junk in Textpattern. You can show your appreciation by sponsoring Textpattern on GitHub or supporting Textpattern on Open Collective. You can donate to Team Textpattern with PayPal.
Textpattern system requirements
Textpattern 4.9 requires a minimum of PHP 5.6 as part of the system requirements, though using a vendor-supported PHP version is highly recommended. There are notable performance gains with modern PHP versions, as well as a variety of security considerations.
Download Textpattern
You can download Textpattern from textpattern.com or GitHub. Both locations provide the same archive files, along with SHA256 checksums for validating your download.
Textpattern is available as a .zip archive intended for single-site instances. Most Textpattern operators will find this archive format appropriate for their needs.
Textpattern administrators wishing to use Textpattern’s multi-site capabilities or having a preference for a UNIX/Linux-centric archive format should download the .tar.gz or .tar.xz archive as they include the necessary extra multi-site scaffold and symbolic links. The unpacked contents of the .tar.xz archive are identical to the .tar.gz archive’s unpacked contents.
From textpattern.com
You can download Textpattern 4.9.2 from textpattern.com using the following links,
File download
File download
File download
From GitHub
Install
Please refer to the Textpattern INSTALL.txt for a comprehensive walkthrough.
Upgrade
We gather field reports from fellow Textpattern administrators and users that may assist or guide you with upgrading. Please use the forum thread dedicated to Textpattern CMS 4.9.2 feedback.
Please refer to the Textpattern UPGRADE.txt for the upgrade procedure. This file is included in the Textpattern archive and linked here for your convenience.
As with any software update, please ensure you verify working backups of Textpattern sites you are upgrading before undertaking any modifications. This includes the Textpattern database and files, plus any file and/or image uploads.
The vast majority of Textpattern upgrades complete without incident. On the rare occasion something does go astray it’s preferable to restore the known-good version from your full site backup and troubleshoot any issues while your site continues to be available on the prior version.
What’s new in Textpattern 4.9.2?
The Textpattern HISTORY.txt outlines changes for this and all previous Textpattern releases, along with their respective release dates. We recommend you read the list of changes to understand how this may affect your current sites, especially if you’re upgrading from older versions. Please note that while upgrades from very old releases of Textpattern are possible, you may need to perform a multi-stage upgrade.
If you require clarification on any aspect of the release notes, we recommend you seek advice before starting a site upgrade. The Textpattern support forum is an excellent place to start, and the Textpattern user documentation provides examples, explanations and background information.
These are selected items from HISTORY.txt in addition to the security issues outlined above:
- Maintenance release with security enhancements, general improvements and bug fixes.
- Fixed:
FROM_UNIXTIME(0)timestamp handling on some MySQL/MariaDB versions. - Fixed: Deleting image(s) deletes corresponding thumbnails (thanks, wet).
- Fixed: Thumbnail generation paths on Windows (thanks, skewray);
- Fixed: Improved
exif_read_data()handling (thanks, towndock). - Fixed:
<txp:password_protect>container error (thanks, wet). - Fixed: Recursive use of
<txp:yield>. - Fixed: Allow upload of plugins where filename length exceeds
PHP_MAXPATHLEN. - Fixed: Theme import with invalid JSON manifest.
- Fixed: Improved Textile support for IETF BCP 47 language tags.
- Fixed: Plugin compilation output: order, not
load_order. - Added:
<txp:file_download_info />tag. - Added: ‘version’ attribute to
<txp:css />tag. - Added: ‘download’ attribute to
<txp:file_download_link />tag. - Added: ‘aspect’ ratio output to
<txp:image_info />tag. - Added: Publishers can set password for any user, and choose whether invite link is sent.
- Added: Latest text translations. Thank you to all our translators.
- Changed: Add
TEXTPATTERN_DEFAULT_LANGtoconfig.phpduring setup. - Vendors: Textile 4.1.6. (thanks, gocom).
Feedback
We are particularly interested in feedback for:
- Compatibility and usability with end-of-life’d PHP releases, factoring in the Textpattern system requirements.
- Usability of the new tag attributes (refer to the Textpattern HISTORY.txt for details).
- Any unexpected issues appearing in the front-side of your Textpattern sites.
- Any unexpected issues shown in admin-side Diagnostics.
We have a dedicated support forum thread for Textpattern 4.9.2 feedback where Textpattern users, experts & developers gather and address feedback. We are grateful for all feedback, even a confirmation that your upgrade(s) completed as expected is appreciated.
We maintain Textpattern issues at GitHub if you would like further insight into where we’re heading with this release and future work.
Further notes
If you find anything not working correctly or wish to propose improvements, please file a report on GitHub. There are templates for feature requests and bug reports.
Textpattern Demo
The Textpattern demo has been updated to offer Textpattern test drives. The demo sites are rebuilt every few hours using the Textpattern auto-installer.
We hope you enjoy this release and it serves you, your sites and clients well!
Thank you for your interest in Textpattern!