YOOTHTHEME ZOO Puro/ZOO Pro 4.1.66

Security​

• CVE-2026-76611: Fix path traversal vulnerability in Gallery element frontend submission
• CVE-2026-76612: Escape template output to prevent cross-site scripting
• CVE-2026-77028: Reject external redirects after frontend submissions
• CVE-2026-77029: Protect front-end and administrator state changes, including submission deletion, from CSRF attacks

Fixed

• Fix enforcement of JSON and CSV extension validation for administrator imports
• Fix frontend submission for Gallery element
• Fix editing comments in frontend
• Fix support for upload MIME validation on Joomla versions earlier than 4.4
• Fix PHP compatibility and deprecation warnings
• Fix verification of TLS certificates and hostnames for Twitter API requests
• Fix Akismet API traffic to use TLS
• Fix to enforce the Download element's configured extension allowlist for uploaded files in frontend submission

v4.1.65​

• Enforce administrator ACL protection for tag management

v4.1.64

• CVE-2026-74803: Fix unauthenticated arbitrary file upload in frontend submission
• CVE-2026-74804: Fix unauthenticated SQL injection in item type filters
• CVE-2026-75114: Reject external redirects in social authentication flows
• Enforce administrator ACL and CSRF protection for tag management

• Fix PHP compatibility

• Fix date picker stacking in frontend submissions

• Fix filesystem compatibility for Joomla 6

• Fix filesystem compatibility for Joomla 6

• Fix category select input field in category edit view (Joomla 6)
• Fix category select width (Joomla 6)
• Fix item priority debounce not being applied in browse view

Changed
Change category select input field in edit view (Joomla 6)

• Change category select input field in edit view (Joomla 6)

• Update system plugin for YOOtheme Pro content sources

• Fix PHP compatibility

• Add support for image thumbnails in webp, avif formats
• Fix alpha index routes in pagination for other character