# FreshRSS 1.26.2 — FreshRSS 1.26.2

- Product: FreshRSS (https://whatsnew.fyi/product/freshrss)
- Vendor: FreshRSS
- Date: 2025-05-03
- Version: 1.26.2
- Original notes: https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.2
- Permalink: https://whatsnew.fyi/product/freshrss/releases/1.26.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Implement JSON string concatenation with & operator
- **added** — Support multiple JSON fragments in HTML+XPath+JSON mode
- **added** — New size option for the Mark as read button
- **added** — New JavaScript event to detect context loaded
- **fixed** — Fix escaping of tag search
- **fixed** — Fix CLI parsing of Boolean flags
- **fixed** — Fix API for labels with slash
- **fixed** — Fix support for feeds with XML preamble + DTD
- **fixed** — Fix file serving for symlinked extensions
- **fixed** — Catch extension exceptions in override
- **security** — Disallow <iframe srcdoc="">
- **security** — Disallow <button formaction="">
- **security** — Improve favicons hash to avoid favicon pollution
- **security** — Add Content-Security-Policy HTTP headers to favicons
- **security** — Web scraping forbid security HTTP headers in cURL
- **security** — Add HTTP headers Referrer-Policy: same-origin
- **security** — Use HTTP POST for logout
- **security** — Make update URL read-only
- **security** — Restrict valid paths in ext.php for extensions
- **security** — Secure serving of user files for extensions

* [Milestone](https://github.com/FreshRSS/FreshRSS/milestones/1.26.2)

This is a security-focussed release for [FreshRSS 1.26.x](https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.1), addressing several CVEs (thanks @Inverle) 🛡 

A few highlights ✨:
* Implement JSON string concatenation with & operator
* Support multiple JSON fragments in HTML+XPath+JSON mode (e.g. JSON-LD)
* Multiple security fixes with CVEs
* Bug fixes

Notes ℹ:
* Favicons will be reconstructed automatically when feeds gets refreshed. After that, you may need to refresh your Web browser as well.

This release has been made by @Alkarex, @Frenzie, @hkcomori, @loviuz, @math-GH
and newcomers @dezponia, @glyn, @Inverle, @Machou, @mikropsoft

Full [changelog](https://github.com/FreshRSS/FreshRSS/blob/1.26.2/CHANGELOG.md):

* Features
	* Implement JSON string concatenation with & operator [#7414](https://github.com/FreshRSS/FreshRSS/pull/7414)
	* Support multiple JSON fragments in HTML+XPath+JSON mode [#7369](https://github.com/FreshRSS/FreshRSS/pull/7369)
* Bug fixing
	* Fix escaping of tag search [#7468](https://github.com/FreshRSS/FreshRSS/pull/7468)
	* Fix CLI parsing of Boolean flags [#7430](https://github.com/FreshRSS/FreshRSS/pull/7430)
	* Fix API for labels with slash [#7437](https://github.com/FreshRSS/FreshRSS/pull/7437)
* SimplePie
	* Fix support for feeds with XML preamble + DTD [#7515](https://github.com/FreshRSS/FreshRSS/pull/7515), [simplepie#914](https://github.com/simplepie/simplepie/pull/914)
	* Merged upstream [#7434](https://github.com/FreshRSS/FreshRSS/pull/7434)
		* Upstream fix [simplepie#912](https://github.com/simplepie/simplepie/pull/912)
* Security
	* Disallow `<iframe srcdoc="">` [#7494](https://github.com/FreshRSS/FreshRSS/pull/7494), [CVE-2025-32015](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wgrq-mcwc-8f8v)
	* Disallow `<button formaction="">` [#7506](https://github.com/FreshRSS/FreshRSS/pull/7506)
	* Improve favicons hash to avoid favicon pollution [#7505](https://github.com/FreshRSS/FreshRSS/pull/7505), [CVE-2025-46339](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8f79-3q3w-43c4)
	* Add `Content-Security-Policy` HTTP headers to favicons [#7471](https://github.com/FreshRSS/FreshRSS/pull/7471), [CVE-2025-31136](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-f6r4-jrvc-cfmr)
	* Web scraping forbid security HTTP headers in cURL [#7496](https://github.com/FreshRSS/FreshRSS/pull/7496), [CVE-2025-46341](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w3m8-wcf4-h8vm)
	* Add some HTTP headers `Referrer-Policy: same-origin` [#6303](https://github.com/FreshRSS/FreshRSS/pull/6303), [#7478](https://github.com/FreshRSS/FreshRSS/pull/7478)
	* Use HTTP POST for logout [#7489](https://github.com/FreshRSS/FreshRSS/pull/7489), [CVE-2025-31482](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-vpmc-3fv2-jmgp)
	* Make update URL read-only [#7477](https://github.com/FreshRSS/FreshRSS/pull/7477)
	* Fix for extensions: Restrict valid paths in `ext.php` [#7479](https://github.com/FreshRSS/FreshRSS/pull/7479), [CVE-2025-31134](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jjm2-4hf7-9x65)
	* Fix for extensions: Secure serving of user files [#7495](https://github.com/FreshRSS/FreshRSS/pull/7495)
* Extensions
	* Fix file serving for symlinked extensions [#7545](https://github.com/FreshRSS/FreshRSS/pull/7545)
	* Catch extension exceptions in override [#7475](https://github.com/FreshRSS/FreshRSS/pull/7475)
	* JavaScript: new event to detect context loaded [#7452](https://github.com/FreshRSS/FreshRSS/pull/7452)
* Deployment
	* Apache: add check for `mod_filter` to ensure that `AddOutputFilterByType` works [#7419](https://github.com/FreshRSS/FreshRSS/pull/7419)
* UI
	* Accessibility: Add `:focus` style to some dropdown menus [#7491](https://github.com/FreshRSS/FreshRSS/pull/7491)
	* New size option for the *Mark as read* b

_[Truncated at 4000 characters — full notes: https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.2]_