# Zulip Server 11.6 — Zulip Server 11.6

- Product: Zulip Server (https://whatsnew.fyi/product/zulip-server)
- Vendor: Zulip
- Date: 2026-03-31
- Version: 11.6
- Original notes: https://github.com/zulip/zulip/releases/tag/11.6
- Permalink: https://whatsnew.fyi/product/zulip-server/releases/11.6

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fixed a vulnerability where a carefully crafted export tarball could cause the importing server to copy any file the zulip user could read into the uploads directory during import
- **security** — Fixed a vulnerability where attachments originating from web-public channels would still be available without logging in even after web-public access was disabled
- **security** — Fixed a vulnerability where the topic list API was accessible without logging in for web-public channels
- **added** — Added imports for all LDAP object types to the new server settings.py template
- **added** — Ensured that logrotate is installed in Docker
- **changed** — Improved error messages when required settings were missing
- **fixed** — Fixed upgrade-postgresql when extensions needed extra steps
- **fixed** — Fixed configuration section names on error pages when proxies were misconfigured
- **fixed** — Fixed generate incoming email address to respect the user's choice of sender
- **added** — Added documentation for INSTALLATION_NAME setting when configuring outgoing email
- **fixed** — Fixed a potential race condition when adding emoji
- **fixed** — Fixed an error when the client attempted to upload a file with a NULL byte in its filename
- **fixed** — Fixed restore-backup when restoring with a remote PostgreSQL instance with an explicit port
- **fixed** — Fixed the Zulip version in Camo's user-agent lagging to the previous deploy's
- **changed** — Adjusted the default PASSWORD_MIN_LENGTH setting to 8, up from 6

_Released 2026-03-31_

- CVE-2026-26058: A carefully crafted export tarball could cause the
  importing server to copy any file the `zulip` user could read into
  the uploads directory during import. This vulnerability was
  reported by Garett Kopcha (@0x5t).
- CVE-2026-25742: Even after web-public access was disabled,
  attachments originating from web-public channels would still be
  available without logging in. A similar vulnerability existed for
  the topic list API. This vulnerability was reported by Sho Odagiri
  of GMO Cybersecurity by Ierae, Inc.
- Added imports for all LDAP object types to the new server `settings.py`
  template.
- Ensured that logrotate is installed, which it was not previously in Docker.
- Improved error messages when required settings were missing.
- Fixed `upgrade-postgresql` when extensions needed extra steps.
- Fixed configuration section names on error pages when proxies were
  misconfigured.
- Fixed “generate incoming email address” to respect the user’s choice of
  sender.
- Added documentation for `INSTALLATION_NAME` setting when configuring outgoing
  email.
- Fixed a potential race condition when adding emoji.
- Fixed an error when the client attempted to upload a file with a NULL byte in
  its filename.
- Fixed restore-backup when restoring with a remote PostgreSQL instance with an
  explicit port.
- Fixed the Zulip version in Camo’s user-agent lagging to the previous deploy’s.
- Adjusted the default `PASSWORD_MIN_LENGTH` setting to 8, up from 6.
- Updated Python dependencies.
- Updated puppet dependencies.
- Updated translations from Weblate.