Skip to content

Release history

cypht releases

Cypht: Lightweight Open Source webmail aggregator [PHP, JS]. Supports IMAP/SMTP, JMAP and EWS (Exchange Web Services)

All releases

10 shown

Review required
v2.12.0 Mixed
RCE / SSRF Dependencies

Tags colors, IMAP safety, mobile UI, SSRF block, Docker updates

Upgrade now
v2.11.2 Security relevant
RCE / SSRF

SSRF block

Monitor
v2.11.1 Security relevant

MSTNEF parsing safety

Review required
v2.11.0 Maintenance
Auth Dependencies

Frontend, CardDAV, backend, Docker, dependencies

Review required
v2.10.1 Security relevant
Auth

CSS tracking blocked

Upgrade now
v2.10.0 Bug fix
Dependencies

Frontend, backend, SMTP, profiles, workflow

Monitor
v2.9.0 New feature
Auth Dependencies

Scheduled sends, lockout, MTA-STS, contacts revamp, folder search

v2.8.0 Security relevant
Security fixes
  • CVE-2026-30838 — updated commonmark to 2.8.1, then bumped league/commonmark to 2.8.2
Notable features
  • Search recipient autocomplete by nickname and company
  • Add Monolog structured logging with environment‑based configuration
  • Allow HTML signature in the profile
Full changelog

187 changes from 9 contributors (of which 1 is a new contributor). 124 files were affected.

What's Changed

New features

  • feat(other): search by nickname and company in recipient autocomplete by @IrAlfred in https://github.com/cypht-org/cypht/pull/1890
  • feat(other): add Monolog for structured logging with environment-based configuration by @IrAlfred in https://github.com/cypht-org/cypht/pull/1891
  • feat(other): allow HTML signature in the profile by @IrAlfred in https://github.com/cypht-org/cypht/pull/1896
  • feat(frontend): add configurable/custom action buttons by @camilevahviraki in https://github.com/cypht-org/cypht/pull/1764
  • feat(other): add module-aware PHP dependency checker to build script by @IrAlfred in https://github.com/cypht-org/cypht/pull/1830
  • feat(backend): add possibility to send php errors to glitchtip by @josaphatim in https://github.com/cypht-org/cypht/pull/1901
  • feat(frontend): add complete Polish interface translation by @szporwolik in https://github.com/cypht-org/cypht/pull/1907
  • feat(backend): implement support for application/ms-tnef message by @mercihabam in https://github.com/cypht-org/cypht/pull/1902
  • feat(module/2fa): auto-generate APP_2FA_SECRET in config_gen when unset by @IrAlfred in https://github.com/cypht-org/cypht/pull/1925
  • feat(frontend/backend): support configurable page query parameter name by @mercihabam in https://github.com/cypht-org/cypht/pull/1919
  • feat(backend): disable archive button when ews In-Place Archive is not provisioned by @kambereBr in https://github.com/cypht-org/cypht/pull/1936
  • feat(frontend): show collapsed nav subitems on hover by @mercihabam in https://github.com/cypht-org/cypht/pull/1932

Bug fixes

  • fix(other): point docker compose to latest Cypht release 2.7.0 by @IrAlfred in https://github.com/cypht-org/cypht/pull/1887
  • fix(backend): ensure that css-hidden content in messages is not shown in Cypht as well and no HTML head content embedded in the output by @mercihabam in https://github.com/cypht-org/cypht/pull/1888
  • fix(backend): prioritize exact, case-insensitive match over substring-based when searching for a message body struct. Preventing falsy match of subtype (e.g., 'x-amp-html' to 'html') by @mercihabam in https://github.com/cypht-org/cypht/pull/1889
  • fix(workflow): allow underscores and digits in module scope pattern by @IrAlfred in https://github.com/cypht-org/cypht/pull/1893
  • fix(other): update commonmark to version 2.8.1 to fix CVE-2026-30838 by @IrAlfred in https://github.com/cypht-org/cypht/pull/1892
  • fix(other): fix "TRANSLATION NOT FOUND" warnings by @IrAlfred in https://github.com/cypht-org/cypht/pull/1895
  • fix(frontend): css: visual fixes to the calendar and contacts page by @pom2ter in https://github.com/cypht-org/cypht/pull/1894
  • fix(other): only init KindEditor for signature in HTML compose mode by @IrAlfred in https://github.com/cypht-org/cypht/pull/1898
  • fix(backend): allow custom sources by @josaphatim in https://github.com/cypht-org/cypht/pull/1899
  • build(deps): bump league/commonmark from 2.8.1 to 2.8.2 by @dependabot[bot] in https://github.com/cypht-org/cypht/pull/1900
  • fix(backend): correct cache path for folder names in message list type handler by @Shadow243 in https://github.com/cypht-org/cypht/pull/1910
  • fix(module/imap): fix snooze feature by @josaphatim in https://github.com/cypht-org/cypht/pull/1908
  • fix(other): align league/commonmark version between composer.json and lock file by @IrAlfred in https://github.com/cypht-org/cypht/pull/1915
  • fix(other): remove custom log file path and default to empty from env config to use default PHP error log by default by @IrAlfred in https://github.com/cypht-org/cypht/pull/1916
  • fix(backend): gmail_contacts - migrate to Google People API v1 by @szporwolik in https://github.com/cypht-org/cypht/pull/1905
  • fix(frontend): stabilize filter editing, custom actions, and ux by @camilevahviraki in https://github.com/cypht-org/cypht/pull/1912
  • fix(module/sievefilters): avoid duplicate modal bindings and invalid main_sc… by @camilevahviraki in https://github.com/cypht-org/cypht/pull/1921
  • fix(other): show nav menu on save page by adding missing route entry and supporting handler-less routes by @IrAlfred in https://github.com/cypht-org/cypht/pull/1922
  • fix(frontend): message page had a title Filter by @camilevahviraki in https://github.com/cypht-org/cypht/pull/1926
  • fix(frontend): visual fixes for message list and mobile by @pom2ter in https://github.com/cypht-org/cypht/pull/1927
  • fix(other): use db_name for SQLite DSN instead of db_socket by @IrAlfred in https://github.com/cypht-org/cypht/pull/1929
  • fix(module/highlights): fix highlights module bugs by @IrAlfred in https://github.com/cypht-org/cypht/pull/1931
  • fix(module/imap_folders): clear parent folder cache on subfolder creation by @IrAlfred in https://github.com/cypht-org/cypht/pull/1934
  • fix(other): run composer install before setup.sh in Test-phpunit job by @IrAlfred in https://github.com/cypht-org/cypht/pull/1933
  • fix(docker): remove misleading unused nginx default site config by @IrAlfred in https://github.com/cypht-org/cypht/pull/1940
  • fix(backend): ensure Hm_Mailbox is constructed with a connection type by @mercihabam in https://github.com/cypht-org/cypht/pull/1941
  • fix(other): update version reference to 2.8.0 for upcoming release by @IrAlfred in https://github.com/cypht-org/cypht/pull/1939
  • fix(e2e): fix CI sqlite setup and replace flaky navigation wait with deterministic counter + AJAX idle check by @IrAlfred in https://github.com/cypht-org/cypht/pull/1942

Refactoring

  • refactor(frontend/backend): propose sieve filter actions according to server extensions by @josaphatim in https://github.com/cypht-org/cypht/pull/1897
  • refactor(frontend): maintain a dedicated logout page to separate session termination from navigation handling, preventing related issues by @mercihabam in https://github.com/cypht-org/cypht/pull/1750
  • refactor(frontend): move some JS code of the sievefilter module for execution in route handlers instead of a global execution by @mercihabam in https://github.com/cypht-org/cypht/pull/1903
  • refactor(frontend): imap folders page to show wich folder is being edited by @camilevahviraki in https://github.com/cypht-org/cypht/pull/1923

New Contributors

  • @szporwolik made their first contribution in https://github.com/cypht-org/cypht/pull/1907

Full Changelog: https://github.com/cypht-org/cypht/compare/v2.7.0...v2.8.0

v2.7.0 New feature
Security fixes
  • Fixed decompression-bomb safeguards bypass when following HTTP redirects
Notable features
  • Trash message restore functionality
  • OPML import for RSS/ATOM subscriptions
  • Context-aware delete warnings
v2.6.0 New feature
Notable features
  • Calendar invitation support with icon
  • Active Directory UPN and domain\user authentication
  • Improved email UI with unread counts

Beta — feedback welcome: [email protected]