Mura 10: Release Notes

Version 10.1.9.1

HOTFIX VERSION Security release. Upgrading is recommended for all deployments. Covers JSON API authorization (MCPD-311), magic links (MCPD-312), remote feeds (MCPD-314), the comments proxy (MCPD-315), feed query validation (MCPD-317), CKEditor uploads (MCPD-318), the Mura.js client library (MCPD-319), the ratings and favorites modules (MCPD-321), site map and navigation markup (MCPD-322) and File Manager uploads (MCPD-330 / MCPD-333). More information available on Mura Github wiki. https://github.com/murasoftware/mura/wiki

Added

  • New trustedFeedHosts setting, letting a site nominate hosts that may be fetched as feeds even when they resolve to a private or internal address. It is comma-delimited, can be set server-wide or per-site, and is additive: site entries are combined with the server-wide list. Each entry grants the whole host, including every port. Use it if an internal feed stops rendering after upgrading. MCPD-314

Changed

  • Remote feed fetches no longer follow redirects. A feed stored as a redirecting URL, such as a publisher short link or an http:// address that redirects to https://, will stop rendering. Store the feed's final URL instead. MCPD-314
  • A View All link whose address contains a quote, apostrophe or angle bracket now renders as no link rather than as broken markup. MCPD-314
  • Unauthenticated callers of the JSON API that previously read entity schemas or wrote comments now receive 401. There is no configuration option to restore the prior behavior. Decoupled front ends that post comments or read schemas anonymously must authenticate. MCPD-311
  • deleteRSSFavorite.cfm has been removed. MCPD-321
  • The ratings and favorites endpoints now require POST and a CSRF token. This is a deliberate breaking change for any custom integration that calls those endpoints directly and for any theme that carries its own copy of the rater or favorites module or their JavaScript; such a theme will stop rating or favoriting after upgrade with no visible error. Check for theme-local copies of modules/rater/index.cfm, modules/favorites/index.cfm, rater.js, rater-jquery.js and favorites-jquery.js. An overriding theme must render the CSRF token pair, POST with csrf_token and csrf_token_expires in the form body, write the replacement token from each response back into the page, stop sending a user ID, and build favorite rows from the href and title fields using DOM APIs. MCPD-321

Fixed

  • A failed feed fetch during a scheduled import no longer aborts the run. Previously a single unreachable or redirecting feed could stop the import for every remaining feed on every remaining site. MCPD-314
  • Feed URL warnings are now written once per URL instead of once per visitor page view, and a feed stopped at a redirect is now logged rather than rendering empty with no trace. MCPD-314
  • The user feed advanced search accepts extended attribute fields again. The field allow-list added in 10.1.9 rejected unqualified field names, which are extended attributes matched through parameterized queries. Qualified table fields are still limited to the user tables and the deny list still applies.
  • The mega menu no longer errors on SQL Server.

Security

  • JSON API: reading an entity's metadata now requires the same access as reading its records, comment writes require an authenticated session, and theme names supplied to async object rendering are validated and contained before use. Regression tests included. MCPD-311
  • Login and magic links: removed a leftover debug hook from the login request handler. Magic link activation now verifies and consumes the token during the activation request itself, enforces expiry and single use atomically, no longer forwards the token in the redirect, and fails closed when the account cannot be logged in. Regression tests included. MCPD-312
  • Remote feeds: fixed a server-side request forgery issue in the visitor-facing feed fetch and the admin Import preview. Feed addresses are validated before the server fetches them and redirects are no longer followed. Fixed a cross-site scripting issue in the View All link of collection and feed display objects; the value is now validated centrally before any display object template renders, so custom themes are covered without a theme change. A feed address using an unsafe scheme is rejected at save and is not rendered as a link in the admin. MCPD-314
  • Comments proxy: the comments proxy endpoints are restricted to authorized users, comment flagging requires POST and a CSRF token, responses are limited to the fields the comment editor needs, and moderation actions require editor rights and are scoped to the comment's site. Regression tests included. MCPD-315
  • Closed an information disclosure issue in feed and async object rendering that could reveal database schema details to unauthenticated callers. Caller-supplied filter fields and table parameters are now validated before any query is built. Regression tests included. MCPD-317
  • The CKEditor upload endpoint now correctly enforces its CSRF token check. MCPD-318
  • Mura.js: template placeholders in parseStringAsTemplate no longer evaluate JavaScript expressions and are resolved only against an explicitly supplied data object (see the upgrade note below). URL fragment and query string values are handled safely, and client-side redirects are limited to safe protocols. MCPD-319
  • Ratings and favorites: the AJAX endpoints accept POST only, require a single-use CSRF token, derive the acting user from the session, validate the site ID, and bound the rating value. saveFavorite.cfm now returns plain data instead of pre-built HTML, and the rater no longer writes a rating as a side effect of rendering. A shared request guard and regression tests were added. MCPD-321
  • Site map and navigation: fixed cross-site scripting issues in the Site Map display object and in generated navigation links; values are now encoded at render and unsafe link schemes are blocked. Requests for sitemap.xml and robots.txt now validate the site ID before it is used. MCPD-322
  • File Manager uploads now sanitize the destination path and enforce the folder access rules of the target directory, and executable file types are limited to the code areas a superuser is already allowed to manage. Regression tests included. MCPD-330 / MCPD-333

Upgrade note: parseStringAsTemplate signature change

parseStringAsTemplate is a public method on the global Mura object. Its signature changed from one argument to two:

// before: resolved ${name} against whatever was in scope
Mura.parseStringAsTemplate("Hello ${name}");

// after: you must pass the values explicitly
Mura.parseStringAsTemplate("Hello ${name}", { name: "Chris" });

Who is affected: only code that calls Mura.parseStringAsTemplate (or getMura().parseStringAsTemplate) directly: typically a custom theme, plugin, or decoupled front end. Mura core itself does not call this function, and no bundled theme uses it.

Symptom if affected: it fails quietly: nothing throws and the page still renders. What you see depends on the placeholder:

  • A simple placeholder such as ${name} with no data passed resolves to an empty string.
  • A placeholder containing anything other than a name or dot path (a calculation, a function call) is no longer recognised and is printed to the page verbatim, including the ${ and }.
  • A value that resolves to null or undefined yields an empty string; other non-string values are converted to text.

How to fix: pass the values the template needs as a second argument, a plain object keyed by the placeholder names. Nested values work with dot paths, for example ${user.email} resolves against { user: { email: "..." } }. Only simple dot-path placeholders are supported now: compute anything else in your own code first and pass the result in.

Version 10.1.9.1-RC

HOTFIX VERSION Security release. Upgrading is recommended for all deployments. Covers JSON API authorization (MCPD-311), magic links (MCPD-312), remote feeds (MCPD-314), the comments proxy (MCPD-315), feed query validation (MCPD-317), CKEditor uploads (MCPD-318), the Mura.js client library (MCPD-319), the ratings and favorites modules (MCPD-321), site map and navigation markup (MCPD-322) and File Manager uploads (MCPD-330 / MCPD-333). More information available on Mura Github wiki. https://github.com/murasoftware/mura/wiki

Added

  • New trustedFeedHosts setting, letting a site nominate hosts that may be fetched as feeds even when they resolve to a private or internal address. It is comma-delimited, can be set server-wide or per-site, and is additive: site entries are combined with the server-wide list. Each entry grants the whole host, including every port. Use it if an internal feed stops rendering after upgrading. MCPD-314

Changed

  • Remote feed fetches no longer follow redirects. A feed stored as a redirecting URL, such as a publisher short link or an http:// address that redirects to https://, will stop rendering. Store the feed's final URL instead. MCPD-314
  • A View All link whose address contains a quote, apostrophe or angle bracket now renders as no link rather than as broken markup. MCPD-314
  • Unauthenticated callers of the JSON API that previously read entity schemas or wrote comments now receive 401. There is no configuration option to restore the prior behavior. Decoupled front ends that post comments or read schemas anonymously must authenticate. MCPD-311
  • deleteRSSFavorite.cfm has been removed. MCPD-321
  • The ratings and favorites endpoints now require POST and a CSRF token. This is a deliberate breaking change for any custom integration that calls those endpoints directly and for any theme that carries its own copy of the rater or favorites module or their JavaScript; such a theme will stop rating or favoriting after upgrade with no visible error. Check for theme-local copies of modules/rater/index.cfm, modules/favorites/index.cfm, rater.js, rater-jquery.js and favorites-jquery.js. An overriding theme must render the CSRF token pair, POST with csrf_token and csrf_token_expires in the form body, write the replacement token from each response back into the page, stop sending a user ID, and build favorite rows from the href and title fields using DOM APIs. MCPD-321

Fixed

  • A failed feed fetch during a scheduled import no longer aborts the run. Previously a single unreachable or redirecting feed could stop the import for every remaining feed on every remaining site. MCPD-314
  • Feed URL warnings are now written once per URL instead of once per visitor page view, and a feed stopped at a redirect is now logged rather than rendering empty with no trace. MCPD-314
  • The user feed advanced search accepts extended attribute fields again. The field allow-list added in 10.1.9 rejected unqualified field names, which are extended attributes matched through parameterized queries. Qualified table fields are still limited to the user tables and the deny list still applies.
  • The mega menu no longer errors on SQL Server.

Security

  • JSON API: reading an entity's metadata now requires the same access as reading its records, comment writes require an authenticated session, and theme names supplied to async object rendering are validated and contained before use. Regression tests included. MCPD-311
  • Login and magic links: removed a leftover debug hook from the login request handler. Magic link activation now verifies and consumes the token during the activation request itself, enforces expiry and single use atomically, no longer forwards the token in the redirect, and fails closed when the account cannot be logged in. Regression tests included. MCPD-312
  • Remote feeds: fixed a server-side request forgery issue in the visitor-facing feed fetch and the admin Import preview. Feed addresses are validated before the server fetches them and redirects are no longer followed. Fixed a cross-site scripting issue in the View All link of collection and feed display objects; the value is now validated centrally before any display object template renders, so custom themes are covered without a theme change. A feed address using an unsafe scheme is rejected at save and is not rendered as a link in the admin. MCPD-314
  • Comments proxy: the comments proxy endpoints are restricted to authorized users, comment flagging requires POST and a CSRF token, responses are limited to the fields the comment editor needs, and moderation actions require editor rights and are scoped to the comment's site. Regression tests included. MCPD-315
  • Closed an information disclosure issue in feed and async object rendering that could reveal database schema details to unauthenticated callers. Caller-supplied filter fields and table parameters are now validated before any query is built. Regression tests included. MCPD-317
  • The CKEditor upload endpoint now correctly enforces its CSRF token check. MCPD-318
  • Mura.js: template placeholders in parseStringAsTemplate no longer evaluate JavaScript expressions and are resolved only against an explicitly supplied data object (see the upgrade note below). URL fragment and query string values are handled safely, and client-side redirects are limited to safe protocols. MCPD-319
  • Ratings and favorites: the AJAX endpoints accept POST only, require a single-use CSRF token, derive the acting user from the session, validate the site ID, and bound the rating value. saveFavorite.cfm now returns plain data instead of pre-built HTML, and the rater no longer writes a rating as a side effect of rendering. A shared request guard and regression tests were added. MCPD-321
  • Site map and navigation: fixed cross-site scripting issues in the Site Map display object and in generated navigation links; values are now encoded at render and unsafe link schemes are blocked. Requests for sitemap.xml and robots.txt now validate the site ID before it is used. MCPD-322
  • File Manager uploads now sanitize the destination path and enforce the folder access rules of the target directory, and executable file types are limited to the code areas a superuser is already allowed to manage. Regression tests included. MCPD-330 / MCPD-333

Upgrade note: parseStringAsTemplate signature change

parseStringAsTemplate is a public method on the global Mura object. Its signature changed from one argument to two:

// before: resolved ${name} against whatever was in scope
Mura.parseStringAsTemplate("Hello ${name}");

// after: you must pass the values explicitly
Mura.parseStringAsTemplate("Hello ${name}", { name: "Chris" });

Who is affected: only code that calls Mura.parseStringAsTemplate (or getMura().parseStringAsTemplate) directly: typically a custom theme, plugin, or decoupled front end. Mura core itself does not call this function, and no bundled theme uses it.

Symptom if affected: it fails quietly: nothing throws and the page still renders. What you see depends on the placeholder:

  • A simple placeholder such as ${name} with no data passed resolves to an empty string.
  • A placeholder containing anything other than a name or dot path (a calculation, a function call) is no longer recognised and is printed to the page verbatim, including the ${ and }.
  • A value that resolves to null or undefined yields an empty string; other non-string values are converted to text.

How to fix: pass the values the template needs as a second argument, a plain object keyed by the placeholder names. Nested values work with dot paths, for example ${user.email} resolves against { user: { email: "..." } }. Only simple dot-path placeholders are supported now: compute anything else in your own code first and pass the result in.

Version 10.1.9

Custom tag and module enhancements, security fixes, plus search, installation, and category fixes.

Added

  • New multi-select custom tag and sorting support for the <name_value_array> custom tag in the module configurator. MCPD-282
  • Keyword search matching the action column; Action/Type filter dropdowns populated from actual audit data.

Changed

  • Module preview thumbnails now support root-relative paths, allowing thumbnails to be served from local theme paths instead of always resolving relative to the admin directory. MCPD-279
  • auditTrailManager.logEvent() deriving a blank siteid from the request/session.

Removed

Deprecated

Fixed

  • Fixed search not working for non-admin users. MCPD-293
  • Fixed bcrypt password truncation and cfapplication.cfm creation on fresh installs. BS-12534
  • Fixed content assignment to categories that do not have the featureable option enabled. BS-12463

Security

  • Added additional permission checks to legacy editor support endpoints so they now require an authenticated user with appropriate access. Upgrading is recommended for all deployments.
  • Hardened contentNavBean dynamic getter/setter dispatch by validating property names with isValid('variableName', ...) before the isDefined(this.get/set#prop#) check, matching the existing guard in bean.cfc/beanExtendable.cfc. Property names containing brackets, hashes, or other non-identifier characters now fall through to the literal struct lookup instead of being evaluated as an expression by isDefined() on Adobe ColdFusion.
  • Hardened JSON API method resolution in apiUtility.cfc so the method derived from the URL path always takes precedence over a method value passed via URL or form parameters, preventing request parameters from overriding the path-based method.
  • Hardened the JSON API and content-feed query layer against a SQL injection vulnerability. Request parameters are no longer able to influence feed query construction in unintended ways, and feed field identifiers are now strictly validated before use in a query. Upgrading is strongly recommended for all deployments.
  • Hardened redirect handling in the JSON API and Mura.js so that request parameters can no longer influence client-side navigation. Upgrading is recommended for all deployments.
  • Fixed an authentication bypass in the /tag/ remote endpoint that could allow unauthenticated access to protected functionality. (CVE-2024-32643) Upgrading is strongly recommended for all deployments.
  • Links generated in system emails (such as password reset links) now validate the request host against the site's configured domains, preventing a spoofed Host header from redirecting users to an attacker-controlled site. (CVE-2024-32642)
  • Moved the admin ajax response buffer out of the request context to close a cross-site scripting (XSS) vector in admin ajax responses. (CVE-2025-66492)
  • Unauthorized async object calls can no longer pass feed configuration parameters, and objectparams handling was hardened, closing a server-side request forgery (SSRF) path. Upgrading is recommended for all deployments.
  • Added regression tests pinning the host-trust and feed-parameter protections.

Version 10.1.9-RC

Added

  • New multi-select custom tag and sorting support for the <name_value_array> custom tag in the module configurator. MCPD-282
  • Keyword search matching the action column; Action/Type filter dropdowns populated from actual audit data.

Changed

  • Module preview thumbnails now support root-relative paths, allowing thumbnails to be served from local theme paths instead of always resolving relative to the admin directory. MCPD-279
  • auditTrailManager.logEvent() deriving a blank siteid from the request/session.

Removed

Deprecated

Fixed

  • Fixed search not working for non-admin users. MCPD-293
  • Fixed bcrypt password truncation and cfapplication.cfm creation on fresh installs. BS-12534
  • Fixed content assignment to categories that do not have the featureable option enabled. BS-12463

Security

  • Added additional permission checks to legacy editor support endpoints so they now require an authenticated user with appropriate access. Upgrading is recommended for all deployments.
  • Hardened contentNavBean dynamic getter/setter dispatch by validating property names with isValid('variableName', ...) before the isDefined("this.get/set#prop#") check, matching the existing guard in bean.cfc/beanExtendable.cfc. Property names containing brackets, hashes, or other non-identifier characters now fall through to the literal struct lookup instead of being evaluated as an expression by isDefined() on Adobe ColdFusion.
  • Hardened JSON API method resolution in apiUtility.cfc so the method derived from the URL path always takes precedence over a method value passed via URL or form parameters, preventing request parameters from overriding the path-based method.
  • Hardened the JSON API and content-feed query layer against a SQL injection vulnerability. Request parameters are no longer able to influence feed query construction in unintended ways, and feed field identifiers are now strictly validated before use in a query. Upgrading is strongly recommended for all deployments.
  • Hardened redirect handling in the JSON API and Mura.js so that request parameters can no longer influence client-side navigation. Upgrading is recommended for all deployments.

Version 10.1.8.1

HOTFIX VERSION

More information available on Mura Github wiki. https://github.com/murasoftware/mura/wiki/HOTFIX-10.1.8.1

Added

Changed

  • Reversed default behavior to allow dynamic content. Added settings.ini variable to force disable dynamic content (allowunsafedynamiccontent) and added audit endpoint so show impacted content nodes (findDynamicContentTags) if allowunsafedynamiccontent is set to false.

Removed

Deprecated

Fixed

Security

  • Bootstrap CVE fixes

Version 10.1.8

New auditing capabilities and security improvements.

Added

  • Admin Audit Trail feature to log create, update, and delete actions across the admin interface. See docs/audit-trail.md for more information. MCPD-206
  • MegaMenu example module. MCPD-176
  • Hide Module functionality in Layout Manager MCPD-183

Changed

Removed

Deprecated

Fixed

  • Fixed getQueryAttrs() appending and dbtype not being set correctly on queryExecute calls. MCPD-117
  • Fixed invalid params wrapper in query-of-query options struct causing an argument name must be a constant value exception that prevented themes from displaying. MCPD-225
  • Fixed onError handler throwing Can't cast Boolean to Struct when logging exceptions with no underlying Java cause. MCPD-117
  • Fixed race condition in plugin event handler cache where concurrent cache eviction between a key existence check and retrieval could cause an error. MCPD-224
  • Fixed back button on edit user/group screens MCPD-205
  • Fixed findCalendarItems error introduced in version 10.1.7.

Security

  • Hardened SQL injection defenses across sort/order-by parameters and fixed open redirect vulnerabilities in content redirects and referer handling. MCPD-223 & MCPD-237
  • SQL Injection Fix MCPD-218
  • Remote Code Execution fix MCPD-219
  • Fix Unsafe evaluate() MCPD-220 & MCPD-221
  • MagicLink security improvments. MCPD-226

Version 10.1.8-RC

New auditing capabilities and security fixes.

Added

  • Admin Audit Trail feature to log create, update, and delete actions across the admin interface. See docs/audit-trail.md for more information. MCPD-206
  • MegaMenu example module. MCPD-176
  • Hide Module functionality in Layout Manager MCPD-183

Changed

Removed

Deprecated

Fixed

  • Fixed getQueryAttrs() appending and dbtype not being set correctly on queryExecute calls. MCPD-117
  • Fixed invalid params wrapper in query-of-query options struct causing an argument name must be a constant value exception that prevented themes from displaying. MCPD-225
  • Fixed onError handler throwing Can't cast Boolean to Struct when logging exceptions with no underlying Java cause. MCPD-117
  • Fixed race condition in plugin event handler cache where concurrent cache eviction between a key existence check and retrieval could cause an error. MCPD-224
  • Fixed back button on edit user/group screens MCPD-205

Security

  • Hardened SQL injection defenses across sort/order-by parameters and fixed open redirect vulnerabilities in content redirects and referer handling. MCPD-223 & MCPD-237
  • SQL Injection Fix MCPD-218
  • Remote Code Execution fix MCPD-219
  • Fix Unsafe evaluate() MCPD-220 & MCPD-221
  • MagicLink security improvments. MCPD-226

Version 10.1.7.1

HOTFIX VERSION

Adding support for Adobe ColdFusion 2025

Important Upgrade Notes

Please review the following before upgrading. Both items can prevent users from logging in or block installation entirely if not addressed in advance.

Adobe ColdFusion 25: Password Hashing Change

Who is affected: Mura CMS installations on Adobe ColdFusion that are not using the default bcrypt password hashing (controlled by the bcryptpasswords setting in the Mura config/settings.ini.cfm configuration file).

What changes: Adobe ColdFusion 25 modifies how passwords are hashed by default. A direct upgrade on a non-bcrypt installation can leave users unable to log in.

Action required: Before upgrading to Adobe ColdFusion 25, verify your bcryptpasswords setting in settings.ini.cfm. If your installation is not using bcrypt, contact support@blueriver.com for a runbook covering supported upgrade paths and mitigation options. Do not upgrade until you have confirmed your path forward.

Added

Changed

Removed

Deprecated

Fixed

  • Fixed getQueryAttrs() appending and dbtype not being set correctly on queryExecute calls
  • Fixed invalid params wrapper in query-of-query options struct causing an argument name must be a constant value exception that prevented themes from displaying
  • Fixed onError handler throwing Can't cast Boolean to Struct when logging exceptions with no underlying Java cause.

Security

Version 10.1.7

Adding support for Adobe ColdFusion 2025

Important Upgrade Notes

Please review the following before upgrading.

Adobe ColdFusion 25: Password Hashing Change

Who is affected: Mura CMS installations on Adobe ColdFusion that are not using the default bcrypt password hashing (controlled by the bcryptpasswords setting in the Mura config/settings.ini.cfm configuration file).

What changes: Adobe ColdFusion 25 modifies how passwords are hashed by default. A direct upgrade on a non-bcrypt installation can leave users unable to log in.

Action required: Before upgrading to Adobe ColdFusion 25, verify your bcryptpasswords setting in settings.ini.cfm. If your installation is not using bcrypt, contact support@blueriver.com for a runbook covering supported upgrade paths and mitigation options. Do not upgrade until you have confirmed your path forward.

Added

  • Added support for Adobe Cold Fusion 2025. MCPD-167
  • Added support for Lucee 6.2 LTS MCPD-66

Changed

Removed

Deprecated

Fixed

  • Fixes switch case bug and reenable auto-import of RSS feeds. MCPD-199

Security

  • DOCKER ONLY Resolved commons.io vulnerability. MDPD-66

Version 10.1.7-RC

Abode 2025 now supported!

Added

  • Added support for Adobe Cold Fusion 2025. MCPD-167
  • Added support for Lucee 6.x. MCPD-66

Changed

Removed

Deprecated

Fixed

  • Fixes switch case bug and reenable auto-import of RSS feeds. MCPD-199

Security

  • DOCKER ONLY Resolved commons.io vulnerability. MDPD-66

Version 10.1.6

Bug fixes and security updates.

Added

  • Enhanced auto-save feature to provide compatibility to a broader range of modules. MCPD-167

Changed

Removed

Deprecated

Fixed

  • Fixed issue with password reset functionality introduced with password magic links process. MCPD-200
  • Fixed an issue introduced in 10.1.5, that occurs when uploading files to S3. MCPD-186
  • Fixed an issue with the initial database creation script for MSSQL - MCPD-195
  • Improved messaging and error protection when approaching CFML token expiration in edit mode. MCPD-132
  • Certain custom modules that referenced content when rendering were broken when updating the stage with the page’s auto-saved layout, the new approach resolves this issue. MCPD-167
  • Fixed issue with the inline editor not working in version 10.1.6. MCPD-191
  • Confirm a files existence before streaming. MCPD-192
  • Fixing users table pagination. MCPD-44
  • Addressing bug introduced by ColdFusion 2023 Update 17 MCPD-190

Security

  • Addressed a security issue affecting administrative data access. MCPD-188
  • Addressed a security issue pertaining to advanced search in user admin. MCPD-189

Version 10.1.6-RC

 

Bug fixes and security updates.

Added

Changed

Removed

Deprecated

Fixed

  • Improved messaging and error protection when approaching CFML token expiration in edit mode. MCPD-132
  • Certain custom modules that referenced content when rendering were broken when updating the stage with the page’s auto-saved layout, the new approach resolves this issue. MCPD-167
  • Fixed issue with the inline editor not working in version 10.1.6. MCPD-191
  • Confirm a files existence before streaming. MCPD-192
  • Fixing users table pagination. MCPD-44
  • Addressing bug introduced by ColdFusion 2023 Update 17 MCPD-190

Security

  • Addressed a security issue affecting administrative data access. MCPD-188
  • Addressed a security issue pertaining to advanced search in user admin. MCPD-189

Version 10.1.5

Multiple Bug Fixes and some cool new features!

Added

  • Created protected keywords to prevent users from creating content nodes, with the capability to exclude specfic keywords from protection for legacy implementations. MCPD-101
  • Added variable to allow switching between and (default). MCPD-151
  • Added feature to allow Auto-Generated, One-Time Passwords for New Users. MCPD-165
  • Added Autosave feature for front-end content editing. MCPD-167
  • DOCKER ONLY Added supply chain attestations to the Docker image. MCPD-164

Changed

  • Increased character limit for textfield and textarea field types labels in Mura forms to 2500 characters instead of 250 and 50 respectively. MCPD-136
  • Removed indicator from input fields (text box, radio button, etc). MCPD-139

Removed

Deprecated

Fixed

  • Resolved additional content relocation bug in Mura core: users can no longer move content nodes to unauthorized parent nodes. MCPD-170
  • Fixed File Manager pagination bug that reset back to page one when deleting an item. MCPD-169
  • Resolved issue with extended characters being replaced in the exporting/importing of content. MCPD-185
  • Resolved issue with deploying bundles where a key is null in a Mura module. MCPD-187

Security

  • Resolved Local File Inclusion vulnerability that allowed file system access beyond the confines of the application root. MCPD-149
  • Resolved issue whereby a user could create pages in content nodes that they did not have permissions for. MCPD-170
  • Obsfuscated the Email Server Password in the Admin UI. MCPD-174
  • DOCKER ONLY Updated to Tomcat 9.0.108 to resolve vulnerabilities. MCPD-163

Version 10.1.5-RC

Multiple Bug Fixes and some cool new features!

Added

  • Created protected keywords to prevent users from creating content nodes, with the capability to exclude specfic keywords from protection for legacy implementations. MCPD-101
  • Added variable to allow switching between and (default). MCPD-151
  • Added feature to allow Auto-Generated, One-Time Passwords for New Users. MCPD-165
  • Added Autosave feature for front-end content editing. MCPD-167
  • DOCKER ONLY Added supply chain attestations to the Docker image. MCPD-164

Changed

  • Increased character limit for textfield and textarea field types labels in Mura forms to 2500 characters instead of 250 and 50 respectively. MCPD-136
  • Removed indicator from input fields (text box, radio button, etc). MCPD-139

Removed

Deprecated

Fixed

  • Resolved additional content relocation bug in Mura core: users can no longer move content nodes to unauthorized parent nodes . MCPD-170
  • Fixed File Manager pagination bug that reset back to page one when deleting and item. MCPD-169
  • Resolved issue with extended characters being replaced in the exporting/importing of content. MCPD-185
  • Resolved issue with deploying bundles where a key is null in a Mura module. MCPD-187

Security

  • Resolved Local File Inclusion vulnerability that allowed file system access beyond the confines of the application root. MCPD-149
  • Resolved issue whereby a user could create pages in content nodes that they did not have permissions for. MCPD-170
  • Obsfuscated the Email Server Password in the Admin UI. MCPD-174
  • DOCKER ONLY Updated to Tomcat 9.0.108 to resolve vulnerabilities. MCPD-163

Version 10.1.4

New page building experience, plus multiple security updates and bug fixes.

Added

  • To enhance the page-building experience, the Layout Manager now displays visual previews and text descriptions for each module, allowing content editors to instantly identify and select the right component without trial and error. MCPD-111

Changed

  • DOCKER ONLY Updated base image to Debian 13 (trixie).
  • Created variable to disable creation of Swagger documentation. MCPD-153
  • Include missing error dumps to existing error outputs when debug is enabled. MCPD-156

Removed

Deprecated

Fixed

  • Resolved content relocation bug in Mura core: users can no longer move content nodes to unauthorized parent nodes. MCPD-131
  • Resolved issue with duplicate query names MCPD-27
  • Resolved admin function error thrown when deleting page from the front end. MCPD-129

Security

  • Resolved multiple SQL Injection vulnerabilities. MCPD-160 (CVE-2025-67829) MCPD-161 (CVE-2025-67830)
  • Resolved CSRF vulnerabilities. MCPD-142 (CVE-2025-55040) MCPD-143 (CVE-2025-55041) MCPD-144 (CVE-2025- 55042) MCPD-145 (CVE-2025-55043) MCPD-146 (CVE-2025-55044) MCPD-147 (CVE-2025-55045) MCPD- 148 (CVE-2025-55046)

Version 10.1.4-RC

New page building experience, plus multiple security updates and bug fixes.

Added

  • To enhance the page-building experience, the Layout Manager now displays visual previews and text descriptions for each module, allowing content editors to instantly identify and select the right component without trial and error. MCPD-111

Changed

  • DOCKER ONLY Updated base image to Debian 13 (trixie).
  • Created variable to disable creation of Swagger documentation. MCPD-153
  • Include missing error dumps to existing error outputs when debug is enabled. MCPD-156

Removed

Deprecated

Fixed

  • Resolved content relocation bug in Mura core: users can no longer move content nodes to unauthorized parent nodes. MCPD-131
  • Resolved issue with duplicate query names MCPD-27
  • Resolved CSRF vulnerabilities. MCPD-142 MCPD-143 MCPD-144 MCPD-145 MCPD-146 MCPD-147 MCPD-148
  • Resolved admin function error thrown when deleting page from the front end. MCPD-129

Security

  • Resolved multiple SQL Injection vulnerabilities. MCPD-160 MCPD-161

Version 10.1.3

Default Docker image now runs with non-privileged user.   

Added

Changed

Removed

Deprecated

Fixed

  • Added support for Coldfusion (2023 Release) Update 14 and Coldfusion (2021 Release) Update 20 MCPD-118
  • Fixed an issue with a query string that was not properly sorting results. MCPD-110
  • Fixed an admin interface navigation issue. MCPD-90

Security

  • **DOCKER ONLY** Updated services to run as mura_user. This will require updates to your Dockerfile! USER mura_user before copying your files and running the container. MCPD-91
  • Closed IPv6 Open Redirect vulnerability.MCPD-119

Version 10.1.3-RC

Default Docker image now runs with non-privileged user.   

Added

Changed

Removed

Deprecated

Fixed

  • Added support for Coldfusion (2023 Release) Update 14 and Coldfusion (2021 Release) Update 20 MCPD-118
  • Fixed an issue with a query string that was not properly sorting results. MCPD-110
  • Fixed an admin interface navigation issue. MCPD-90

Security

  • **DOCKER ONLY** Updated services to run as mura_user. This will require updates to your Dockerfile! USER mura_user before copying your files and running the container. MCPD-91
  • Closed IPv6 Open Redirect vulnerability.MCPD-119

Version 10.1.2

Multiple security updates for Docker implementations and bug fixes.

Added

Changed

  • Mura.js update. Fixing a reported issue with dynamic pages.
  • DOCKER ONLY Upgraded Tomcat to 9.0.90 to resolve vulnerabilities.
  • DOCKER ONLY Updated Lucee to Lucee Light-5.4.7.2 to resolve vulnerabilities.

Removed

Deprecated

Fixed

  • Fixed preview tooltip in Mura admin
  • DOCKER ONLY Create a directory if one does not exist in the container when assets are mapped to an external source.

Security

  • DOCKER ONLY Resolved CVE-2024-34750
  • DOCKER ONLY Resolved CVE-2024-38286
  • DOCKER ONLY Resolved CVE-2023-46589
  • DOCKER ONLY Resolved CVE-2024-21634
  • DOCKER ONLY Resolved CVE-2024-24549
  • DOCKER ONLY Resolved CVE-2024-23672

Version 10.1.2-RC

Multiple security updates for Docker implementations and bug fixes.

Added

Changed

  • Mura.js update. Fixing a reported issue with dynamic pages.
  • DOCKER ONLY Upgraded Tomcat to 9.0.90 to resolve vulnerabilities.
  • DOCKER ONLY Updated Luceee to Lucee Light-5.4.7.2 to resolve vulnerabilites.

Removed

Deprecated

Fixed

  • Fixed preview tooltip in Mura admin
  • DOCKER ONLY Create a directory if one does not exist in the container when assets are mapped to an external source.

Security

  • DOCKER ONLY Resolved CVE-2024-34750
  • DOCKER ONLY Resolved CVE-2024-38286
  • DOCKER ONLY Resolved CVE-2023-46589
  • DOCKER ONLY Resolved CVE-2024-21634
  • DOCKER ONLY Resolved CVE-2024-24549
  • DOCKER ONLY Resolved CVE-2024-23672

Version 10.1.1

Added Linked Template module and other additional features to the admin interface to facilitate easier site administration and fixed multiple high vulnerabilities.

Added

  • DOCKER ONLY Updated the buildspec.yaml to use docker buildx to facilitate multi architecture build MCPD-68
  • DOCKER ONLY Build action creates ARM and AMD images
  • Added additional functionality to the User Maintenance Form & Group Listing page in the Mura admin. MCPD-93
  • Creates a Linked Template module that automatically updates all instances of the Linked Template on the site when an update to the Linked Template occurs. MCPD-86

Changed

Removed

  • Removed app/config/version.cfm file, version is set in app/core/version.cfm. MCPD-89

Deprecated

Fixed

  • Removed default value of useCategoryIntersect from collections index.cfm file. This should be set on the collection. This default value overrides the setting on the collection. MCPD-48

Security

  • Fixed CSV injection vulnerability MCPD-82
  • Fixed a SSRF vulnerability. MCPD-83

Version 10.1.1-RC

Added Linked Template module and other additional features to the admin interface to facilitate easier site administration and fixed multiple high vulnerabilities.

Added

  • DOCKER ONLY Updated the buildspec.yaml to use docker buildx to facilitate multi architecture build MCPD-68
  • DOCKER ONLY Build action creates ARM and AMD images
  • Added additional functionality to the User Maintenance Form & Group Listing page in the Mura admin. MCPD-93
  • Creates a Linked Template module that automatically updates all instances of the Linked Template on the site when an update to the Linked Template occurs. MCPD-86

Changed

Removed

  • Removed app/config/version.cfm file, version is set in app/core/version.cfm. MCPD-89

Deprecated

Fixed

  • Removed default value of useCategoryIntersect from collections index.cfm file. This should be set on the collection. This default value overrides the setting on the collection. MCPD-48

Security

  • Fixed CSV injection vulnerability MCPD-82
  • Fixed a SSRF vulnerability. MCPD-83

Version 10.1.0

Creating Release Notes and Security Updates

Added

  • CHANGELOG.md to track changes for Release Notes. MCPD-75
  • GitHub Workflow to dynamically create Release Notes in Github on Merge to branch. MCPD-75
  • GitHub Workflows for running Unit Tests. BAD-123

Changed

  • DOCKER ONLY Updated Dockerfile to remove usage of test Lucee image. Lucee version remains 5.4.6.9.

Removed

Deprecated

Fixed

Security

  • DOCKER ONLY Removed old, unused, unsupported Lucee extension JSON 1.0.0. Responsible for 20 Critical and 22 High vulnerabilities

Version 10.1.0-RC

Creating Release Notes and Security Updates

Added

  • CHANGELOG.md to track changes for Release Notes. MCPD-75
  • GitHub Workflow to dynamically create Release Notes in Github on Merge to branch. MCPD-75
  • GitHub Workflows for running Unit Tests. BAD-123

Changed

  • DOCKER ONLY Updated Dockerfile to remove usage of test Lucee image. Lucee version remains 5.4.6.9.

Removed

Deprecated

Fixed

Security

  • DOCKER ONLY Removed old, unused, unsupported Lucee extension JSON 1.0.0. Responsible for 20 Critical and 22 High vulnerabilities