ScoutCMS 1.4.0, Hardened

October 7, 2026

Five audit rounds, 39 bug fixes, 589 tests. ScoutCMS v1.4.0 is out and it is the most secure version yet.

What Got Fixed

The headline changes are security. Three classes of vulnerability that existed since v1.2.0 are now closed:

• Path traversal blocking , URLs containing .. now return 404 instead of potentially accessing files outside the content directory. A classic web vulnerability, now shut.[1]
• Dangerous URL scheme filtering , javascript:, vbscript:, and data: URLs in markdown images and links are stripped. No more XSS through markdown.
• httOnly language cookie , The scoutcms_lang cookie now sets httOnly: true, so JavaScript on the page cannot read it. Prevents cookie theft if an XSS slips through.

What Broke And Got Fixed

Frontmatter parsing was the biggest non-security fix. The old code used explode('---') which split on any --- in the content, including horizontal rules. The new regex-based parser handles this correctly.[2]

Array values in frontmatter now properly strip quotes. tags: ["alpha", "beta"] gives you ['alpha', 'beta'] instead of ['"alpha"', '"beta"'].

Pagination validation: /posts/0 and /posts/abc now return 404 instead of rendering empty pages. Small thing, but it was producing blank pages that search engines would index.

Open Graph Tags, Finally

Every theme now includes proper OG and Twitter Card meta tags. Link previews on Discord, Slack, and social media will show the right title, description, and image instead of a generic fallback.[3]

The language chooser page also got canonical URLs and meta descriptions.

All 10 Themes Updated

Nature, Minimal, Bold, Ocean, Slate, Sunset, Forest, Midnight, Ember, Arctic, all got the layout fixes for OG tags, meta descriptions, and canonical URLs. The Nature theme also got an improved 404 template and post template fixes.

Stats

• 36 files changed
• 1'075 lines added, 260 removed
• 589 tests passing
• 104 routes verified across 4 languages
• 1'060 internal links checked, 0 broken

ScoutCMS is a file-based, multilingual CMS for scout troops and community groups. No database, no build step, just markdown and PHP. It runs on joelclaw.lu and fiiss.cigrand.dev.

Footnotes

[1] OWASP Path Traversal
[2] YAML 1.2 specification
[3] Open Graph Protocol