🖥️ PowerFolder Server 27 SP3

• Release Date: July 2026

• Build Number: 27.3.100

• Type: Service Pack Release

📦 Download Links

• JAR File (Wiki Password required)

• Linux

• Windows

• Outlook Add-In (No changes)

⬆️ Upgrade Information

• Please read this complete Release Notes and instructions before upgrading.

• Please follow the regular upgrade documentation for Windows or Linux

• Upgrading any previous version higher or equal to version 16.0.100

• Cluster: Running different versions on the servers in the cluster is supported but limited to version >= 22.0.100

🔐 Argon2id Password Hashing

PowerFolder now uses Argon2id as the default password hashing algorithm for improved password security.

Enable or disable Argon2id hashing:

New passwords are hashed using Argon2id.

Existing SHA-256 password hashes are automatically migrated after the user's next successful login (lazy migration).

When disabled, all new passwords continue to use SHA-256 and no migration is performed.

Migration

• No batch migration required.

• No downtime.

• Users who have not logged in since the upgrade continue using their existing SHA-256 hash until their next login.

• Password hashing intentionally takes approximately 300–400 ms to improve brute-force resistance.

Monitoring

Each successful migration is logged:

Database hash prefixes:

• ARGON2ID: → Password already migrated.

• SHA-256: → Password not yet migrated.

Downgrade

Argon2id password hashes are not backward compatible with older PowerFolder Server versions.

After downgrading, users whose passwords have already been migrated must reset their password.

📊 Activity Feed Sidebar

The statistics sidebar on the Activity Feed page can now be hidden via server configuration.

Set to:

to hide the statistics sidebar.

📝 OpenDocument (ODF) Support

New documents created in the online editor can now use the OpenDocument Format (ODF) instead of Microsoft Office formats.

Enable ODF creation:

New files will be created as:

• .odt

• .ods

• .odp

When disabled (default), PowerFolder creates:

• .docx

• .xlsx

• .pptx

Requires an active online editor (ONLYOFFICE or WOPI/Collabora).

📂 SMB / Samba Folder Sharing

PowerFolder folders can now be exposed as standard SMB/Samba/CIFS network shares.

Users can access shared folders directly from their operating system using native SMB clients, including Windows File Explorer, macOS Finder and Linux file managers.

Existing PowerFolder permissions continue to control access to the shared folders.

Detailed documentation.

🔍Full-Text Search and OCR

PowerFolder provides built-in full-text search capabilities, allowing users to search within document contents as well as file names. OCR support enables text recognition inside images and scanned PDFs.

Default Configuration

Supported File Types

Document Content Extraction

• PDF

• DOC, DOCX

• XLS, XLSX

• PPT, PPTX

• ODT, ODS, ODP

• RTF

• TXT, CSV, MD

• XML, HTML

• MSG, EML

OCR Processing

• PNG

• JPG, JPEG

• TIFF

• BMP

• Scanned PDFs

OCR Language Presets

Using additional languages may increase OCR processing time.

Background Processing

Content extraction and OCR are performed asynchronously in the background and do not interfere with file synchronization. PowerFolder automatically limits CPU and disk utilization to ensure optimal system performance.

Highlights

• Search inside document contents

• OCR support for images and scanned PDFs

• Multilingual text recognition

• Automatic background indexing

• Resource-aware processing

• No additional user interaction required

• Search indexes are maintained automatically

🔐 Login History

The Login History feature can now be enabled or completely disabled via server configuration:

web.login_history_keep.hours=0

🗂️ Folder Archive Configurability

Deleted top folders are now moved into the user-level archive at:

PowerFolders/username/.PowerFolder/archive

Enable user archive support:

server.archive.user.enabled=true

To disable this functionality and remove the ability for users to restore top folders from the recycle bin set:

server.archive.user.enabled=false

Legacy support for system archive

New default value for:

folderbase.deleteddir=

→ Empty value disables archiving of deleted top folders into the system archive (BACKUP_REMOVE).

For legacy behavior set:

folderbase.deleteddir=BACKUP_REMOVE

Cleanup of Legacy System Archive Folder

The legacy system archive folder:

PowerFolders/BACKUP_REMOVE

is no longer used and can now be safely deleted after the configured system cleanup time.

Restoring top folder from system archive ("BACKUP_REMOVE")

Admins and users are now able to restore top-level folders direct from recycle bin.

web.restore_folder.users.enabled=true

To hide the options from end users set in server config:

web.restore_folder.users.enabled=false

Note: The new functionality is always visible to server admins

👤 Account

Added new API action to create authentication tokens for any account with custom validity support.

API Documentation: https://apidoc.powerfolder.com/#api-Accounts-createTokenForAccount

🌐 Reverse Proxy Stability Improvements

Adjusted default reverse proxy settings for improved stability and performance.

New defaults:

http.proxy.read.timeout.seconds = 30

http.proxy.connect.timeout.seconds = 15

http.proxy.threadpool.max = 200

web.threadpool.min = 10

Deprecated and can now be removed:

http.proxy.timeout.seconds=

🌍 GEO IP Support

GEO IP functionality can now be enabled via configuration:

web.geo.ip=true

🕒 Login History Retention

Added support for automatic purging of Login History entries after 30 days:

web.login_history_keep.hours=720

To turn this function off please use:

web.login_history_keep.hours=0

💻 Client Installation Prompt

The web client installation suggestion popup can now be enabled or disabled via configuration.

Disable the prompt:

web.client_install_prompt.enabled=false

Default setting:

web.client_install_prompt.enabled=true

📱 Automatic Cleanup of Old / Inactive Devices

Added support for automatic removal of old or inactive devices in “My Account” via configuration is now default:

server.devices.cleanup.remove_months=24

To turn off:

server.devices.cleanup.remove_months=0

🔐HARICA Root Certificates Added to Java Truststore

The Java truststore (cacerts) has been updated to include the complete official HARICA Root Certificate portfolio.

Added Root Certificates

The following HARICA Root Certificates are now trusted:

• HARICA Root CA 2011

• HARICA Root CA 2015 (RSA & ECC)

• HARICA TLS Root CA 2021 (RSA & ECC)

• HARICA TLS Root CA 2021 Cross (RSA & ECC)

• HARICA Client Root CA 2021 (RSA & ECC)

• HARICA Qualified Root CA 2021 (RSA & ECC)

🔄 Changing Database Collation to utf8mb4_general_ci in MariaDB v11.x

Attached detailed documentation describing the required database collation adjustment and upgrade procedure: Changing Database Collation to utf8mb4_general_ci

📊Folder Audit Information

More information about this feature: Server Audit Information

🌐WebDAV Token Validity

The default WebDAV token validity is now tecnically 21 years:

security.tokens.webdav.valid.time.seconds=662256000

Server admin can change this as per requirement.

Block folders of expired user

Server admin can now block the shared folders for all users when a account is expired.

Default:

server.account.block.folders.on.expiration=false

Set to:

server.account.block.folders.on.expiration=true

to block and unblock folders of an account when expired/valid again

🛡️Content Security Policy (CSP) Protection

To enhance security against Cross-Site Scripting (XSS) and other injection attacks, the application supports enabling Content Security Policy (CSP) headers. CSP allows the browser to restrict which content sources (scripts, styles, images, etc.) are allowed to load, preventing malicious scripts from executing.

Configuration

The CSP mechanism can be controlled via configuration flags in your server configuration file:

Options

• web.csp.enable

  • Default: true

  • Enables CSP headers in responses.

  • Set to false to completely disable CSP protection (not recommended).

• web.csp.report_only

  • Default: false

  • When false, CSP violations will block content that does not comply with the policy.

  • When true, CSP runs in Report-Only mode: violations are logged/reported, but the browser does not block the content.

  This is useful for debugging potential CSP false positives without breaking user functionality.

✨ New: Default user folders on first login

To simplify onboarding for new users, the system can now automatically create default folders at their first login.
Add the following to your Default.config (server maintenance):

🔄 Javascript in Email Templates

The email templates are also improved, please update the email templates or delete the old templates.

⬇️ Downgrade Information (optional)

• In case a downgrade to a previous version is necessary:

  • For a downgrade, you have to review our downgrade documentation.

  • Simply replace the PowerFolder-Server.jar file with that from the previous version you would like to run.

• Log messages due to the higher schema version of database can be ignored:

  • [DatabaseMigrator]: Database layout version is newer than expected.

📜 Full Changelog

• PFS-5311: Make folders available as SMB/Samba/CIFS shares

• PFS-5574: Redesign server and org admin dashboards

• PFS-4434: Activity stream now has batch restore of all deleted files

• PFS-5522: New default: Argon2id password hashing with lazy migration from SHA-256

• PFS-5474: Global top level file search

• PFS-5431: AntiXSSHandler logs unnecessary XSS escape for invitation tokens with special characters

• PFS-5571: Bundle OCR libraries for linux and skip OCR for files with extracted text

• PFS-5580: Include images by default for OCR

• PFS-5601: Show spinner in share dialog when loading members

• PFS-5608: Option to hide sidebar of activity stream

• PFS-5587: Redesign "News" page into a modern "Activity" feed

• PFS-5524: Invalidate session on username mismatch during federation redirect

• PFC-3485: Versions/Archive of subfolder should use the top level archive scoped to its subdir

• PFS-5518: Support OpenDocument (ODF) format for new file creation in online editor

• PFS-5570: Provide support for OO Docs v9.4.1-15

• PF-1945: Integrate invitation workflow on subfolder invite

• PFS-2573: Store and show changing account in file versioning

• PFS-4278: Provide an option to leave blocked folders as members

• PFS-5557: LoginHistory cleanup causes MySQL deadlocks across the cluster

• PFS-5589: Provide filters in groups tab

• PFS-5583: Update Jetty 9.4.52 → 9.4.58 (OWASP findings) + suppress websocket-extensions false positive

• PFS-5582: Update video.js to 7.21.7 (CVE-2021-23414) and make security-js-scan fail on findings

• PFS-5564: Fix loading filter tags in accounts and orgs in different languages

• PFS-5505: Fix Token authentication in API

• PFS-5576: Correct email notification for active devices

• PFS-5584: Harden token authentication: enforce login after-checks for token-as-password, remove weak nodeID node binding

• PFC-3539: FolderPermission grant silently lost when account has OrganizationAdminPermission

• PFC-3552: Cluster connections drop when v27 client sends subfolder FolderInfo

• PFS-4790: Rename fields parentFolder and path to topFolder

• PFS-5525: Ensure continuously barrier free web portal

• PFS-5542: Velocity template engine gets poisoned with default config on slow server startup

• PFC-3553: ServerInfo connectAddress silently reset to NULL

• PFS-4517: FolderInfo ensure version field is up to date

• PFS-5517: Email Template Cleanup & Editor Improvements

• PFS-5530: Update apidoc with description for groups "addAccount" and "saveAccounts"

• PFS-5534: Extract all Group API actions into Action classes

• PFS-5535: Add context menu (... ) for groups

• PFS-5538: Extract all Storages API actions into Action classes

• PFS-5560: Improve startup time on large installations by batching FolderSettings commits and metadata update in background thread

• PFS-5563: Arrange languages by english names in web

• PFS-5565: Folder/Files table search not applied after page reload

• PFS-5566: Reduce login history table size in DB

• PFS-5573: Hide edit buttons for LDAP/SAML users in my account

• PFS-5585: Groupadmin can downgrade himself

• PFS-5586: renamed groups should show under new name instantly

• PFS-5600: Reduce DB load on cluster cache for FolderInfo and Account

• PFC-3549: Optimize startup time on subfolder structure check

• PFS-5437: Change text for password in Link settings to "Link password"

• PFS-5519: Optimize ClusterCache: targeted auth cache invalidation for Account subregions

• PFS-5606: Cache enabled storages and server uptime

• PFS-5579: Fix deletion of devices in web

• PFS-5594: Fix saving of admin preferences

• PFS-4646: Remove defaultPermission of FolderSettings

• PFS-5430: LoginHistory entries not removed after user deprovisioning

• PFS-5466: Fix remove group from folder

• PFS-5509: Adjust notes field to database column length

• PFS-5558: fix group creation

• PFS-5610: Fix leaving group as member

• PFS-5521: Fix table sorting to use lexicographic order (Excel-like) instead of natural sort

• PFS-5540: Adjust search in Register Address

• PF-1951: Improve API documentation with authentication guide, consistent examples, and accurate parameter/error documentation.

• PFS-5539: Updated BouncyCastle dependencies from mixed version

• PFS-5512: Web: Croatian translation (hr)

• PFS-5513: Web: Ukrainian translation (uk)

• PFS-5533: Web: Urdu translation (ur)

• PFS-5543: Web: Estonian translation (et)

• PFS-5544: Web: Persian translation (fa)

• PFS-5545: Web: Irish translation (ga)

• PFS-5546: Web: Hebrew translation (he)

• PFS-5547: Web: Hindi translation (hi)

• PFS-5548: Web: Indonesian translation (id)

• PFS-5549: Web: Japanese translation (ja)

• PFS-5550: Web: Korean translation (ko)

• PFS-5551: Web: Maltese translation (mt)

• PFS-5552: Web: Slovenian translation (sl)

• PFS-5553: Web: Serbian translation (sr)

• PFS-5554: Web: Thai translation (th)

• PFS-5555: Web: Vietnamese translation (vi)

• PFS-5556: Web: Chinese Simplified translation (zh)