zittme 1.0.4 hotfix released — Rhymix 2.1.39 security fixes (RVE-2026-25, 26, 27)
ZITTME CORE RELEASE
zittme 1.0.4
A hotfix that brings in the security fixes (reflected XSS, document ownership, message deletion) and bug fixes from Rhymix 2.1.39.
- Released Oct 21, 2026
- Stable
- Rhymix 2.1.39
- 29 changed files
- No database changes
Hello from the zittme team.
We are releasing zittme 1.0.4. It is a maintenance release that ports the security and bug fixes in Rhymix 2.1.39 onto 1.0.3, and it adds no new features. Because it includes security fixes, we recommend it for every site.
WHAT'S CHANGED
What's changed
4 security fixes, 1 change, 5 bug fixes and 1 version bump, described by the symptoms you would have seen.
Security Rhymix patch
XSS and open redirect via legacy XML requests blocked (RVE-2026-25)
Automatic redirects now happen only when the request URL is inside your site. This blocks a reflected XSS and redirects to outside sites through the legacy XML request format.
Security Rhymix patch
Document owner module checked (RVE-2026-26)
Widget and document save paths now check which module a document belongs to. A module manager can no longer edit, copy or delete documents in modules they do not manage. (KISA KVE-2026-2515)
Security Rhymix patch
Message type and owner checked (RVE-2026-27)
Deleting a message now checks both its type and its owner. Messages in another member's mailbox can no longer be deleted. (KISA KVE-2026-2704)
Security Rhymix patch
SVG sanitizer library updated
The SVG sanitizer library (enshrined/svg-sanitize) is updated from 0.22.0 to 1.0.0. (#2750)
Change Rhymix patch
Email edit lock unified
Email addresses are now locked from editing only when email verification is in use. This also fixes members who use their email as their login ID not being able to save a new email.
Bug fix Rhymix patch
Blank signup and profile pages
The signup and profile edit pages no longer show up blank when the signup form data is broken.
Bug fix Rhymix patch
Notification center cache files piling up
Turning off every notification no longer makes notification center settings cache files pile up without end.
Bug fix Rhymix patch
Module permission cache not saved
The module permission cache is now saved correctly. (#2749)
Bug fix Rhymix patch
Store install version check
Packages that list a short supported version such as "8.4" can now be installed from the Store.
Bug fix Rhymix patch
Add-on, menu and input field cleanup
Fixed missing group headers on the add-on settings page and a warning when a broken menu exists, and unified read-only input fields in the PC and mobile member skins.
Version
Version numbers
ZITTME_VERSION 1.0.4 RX_VERSION 2.1.39
HOW TO UPDATE
How to update
There are no database changes, so you only need to overwrite files. Back up your site files before you start.
-
Download the file for your version
On 1.0.3, get
zittme-1.0.4-changed.zip(29 changed files). On 1.0.2 or earlier, getzittme-1.0.4.zip(full package). -
Check the SHA256
Make sure the SHA256 of the downloaded file matches the value listed under Download below.
-
Overwrite your site root
Extract the archive over your site root as is. The
files/folder and config files are not in the zip, so they stay as they are. -
Check the version
Go to Admin > Dashboard and check that the version shows 1.0.4. If the screen still looks the same, run Admin > Regenerate cache files once.
DOWNLOAD
Download and SHA256
zittme-1.0.4-changed.zip 29 changed files, 1.0.3 → 1.0.4 · 143 KB
f466cfa3d04d20d7d5f05b68dc0d227aebddea9e67553c84cfcddc4b53012ec2
zittme-1.0.4.zip Full package · 14.2 MB
85c87626ebfe83d51606c572b7bac938513a6157e324c0fbc4429782678c381d
Requirements: GPLv2 · PHP 7.4 or later · MySQL or MariaDB
LINKS
Links
Thank you to Rhymix for providing the security and bug fix patches.
If anything is missing or could be better, please send us your feedback at any time. We will use it to keep improving.