/
🖥️ PowerFolder Server 26 SP3

🖥️ PowerFolder Server 26 SP3

This release contains major security fixes. We strongly recommend updating as soon as possible.

 

 

  • Release Date: August 2026

  • Build Number: 26.3.100

  • Type: Service Pack Release

📦 Download Links

⬆️ Upgrade Information

  • Please read this complete Release Notes and instructions before upgrading.

  • Please follow the regular upgrade documentation for Windows or Linux

  • Upgrading any previous version higher or equal to version 16.0.100

  • Cluster: Running different versions on the servers in the cluster is supported but limited to version >= 22.0.100

🔐 Login History

The Login History feature can now be enabled or completely disabled via server configuration:

web.login_history_keep.hours=0

🗂️ Folder Archive Configurability

Deleted top folders are now moved into the user-level archive at:

PowerFolders/username/.PowerFolder/archive

Enable user archive support:

server.archive.user.enabled=true

To disable this functionality and remove the ability for users to restore top folders from the recycle bin set:

server.archive.user.enabled=false

Legacy support for system archive

New default value for:

folderbase.deleteddir=

→ Empty value disables archiving of deleted top folders into the system archive (BACKUP_REMOVE).

For legacy behavior set:

folderbase.deleteddir=BACKUP_REMOVE

Cleanup of Legacy System Archive Folder

The legacy system archive folder:

PowerFolders/BACKUP_REMOVE

is no longer used and can now be safely deleted after the configured system cleanup time.

Restoring top folder from system archive ("BACKUP_REMOVE")

Admins and users are now able to restore top-level folders direct from recycle bin.

web.restore_folder.users.enabled=true

To hide the options from end users set in server config:

web.restore_folder.users.enabled=false

Note: The new functionality is always visible to server admins

👤Account

Added new API action to create authentication tokens for any account with custom validity support.

API Documentation: PowerFolder API Documentation

🌐 Reverse Proxy Stability Improvements

Adjusted default reverse proxy settings for improved stability and performance.

New defaults:

http.proxy.read.timeout.seconds = 30

http.proxy.connect.timeout.seconds = 15

http.proxy.threadpool.max = 200

web.threadpool.min = 10

Deprecated and can now be removed:

http.proxy.timeout.seconds=

🌍 GEO IP Support

GEO IP functionality can now be enabled via configuration:

web.geo.ip=true

🕒 Login History Retention

Added support for automatic purging of Login History entries after 30 days:

web.login_history_keep.hours=720

To turn this function off please use:

web.login_history_keep.hours=0

💻 Client Installation Prompt

The web client installation suggestion popup can now be enabled or disabled via configuration.

Disable the prompt:

web.client_install_prompt.enabled=false

Default setting:

web.client_install_prompt.enabled=true

📱 Automatic Cleanup of Old / Inactive Devices

Added support for automatic removal of old or inactive devices in “My Account” via configuration is now default:

server.devices.cleanup.remove_months=24

To turn off:

server.devices.cleanup.remove_months=0

🔐HARICA Root Certificates Added to Java Truststore

The Java truststore (cacerts) has been updated to include the complete official HARICA Root Certificate portfolio.

Added Root Certificates

The following HARICA Root Certificates are now trusted:

  • HARICA Root CA 2011

  • HARICA Root CA 2015 (RSA & ECC)

  • HARICA TLS Root CA 2021 (RSA & ECC)

  • HARICA TLS Root CA 2021 Cross (RSA & ECC)

  • HARICA Client Root CA 2021 (RSA & ECC)

  • HARICA Qualified Root CA 2021 (RSA & ECC)

🔄 Changing Database Collation to utf8mb4_general_ci in MariaDB v11.x

Attached detailed documentation describing the required database collation adjustment and upgrade procedure: Changing Database Collation to utf8mb4_general_ci

📊Folder Audit Information

More information about this feature: Server Audit Information

🌐WebDAV Token Validity

The default WebDAV token validity is now tecnically 21 years:

security.tokens.webdav.valid.time.seconds=662256000

Server admin can change this as per requirement.

Block folders of expired user

Server admin can now block the shared folders for all users when a account is expired.

Default:

server.account.block.folders.on.expiration=false

Set to:

server.account.block.folders.on.expiration=true

to block and unblock folders of an account when expired/valid again

🛡️Content Security Policy (CSP) Protection

To enhance security against Cross-Site Scripting (XSS) and other injection attacks, the application supports enabling Content Security Policy (CSP) headers. CSP allows the browser to restrict which content sources (scripts, styles, images, etc.) are allowed to load, preventing malicious scripts from executing.

Configuration

The CSP mechanism can be controlled via configuration flags in your server configuration file:

# Enable or disable Content Security Policy web.csp.enable=true # Run in report-only mode or enforce policy web.csp.report_only=false

Options

  • web.csp.enable

    • Default: true

    • Enables CSP headers in responses.

    • Set to false to completely disable CSP protection (not recommended).

  • web.csp.report_only

    • Default: false

    • When false, CSP violations will block content that does not comply with the policy.

    • When true, CSP runs in Report-Only mode: violations are logged/reported, but the browser does not block the content.

    This is useful for debugging potential CSP false positives without breaking user functionality.

✨ New: Default user folders on first login

To simplify onboarding for new users, the system can now automatically create default folders at their first login.
Add the following to your Default.config (server maintenance):

# Default folders f.my_files.name=Meine Dateien f.my_files.dir=Meine Dateien f.shared.name=Geteilt f.shared.dir=Geteilt

🔄 Javascript in Email Templates

The email templates are also improved, please update the email templates or delete the old templates.

⬇️ Downgrade Information (optional)

  • In case a downgrade to a previous version is necessary:

    • For a downgrade, you have to review our downgrade documentation.

    • Simply replace the PowerFolder-Server.jar file with that from the previous version you would like to run.

  • Log messages due to the higher schema version of database can be ignored:

    • [DatabaseMigrator]: Database layout version is newer than expected.

📜 Full Changelog

  • PFS-5641: Security fix

  • INT-1726: Security fix

  • INT-1727: Security fix

  • INT-1728: Security fix

  • INT-1729: Security fix

  • INT-1730: Security fix

  • INT-1731: Security fix

  • INT-1732: Security fix

  • INT-1733: Security fix

  • INT-1734: Security fix

  • INT-1735: Security fix

  • INT-1736: Security fix

  • INT-1737: Security fix

  • INT-1725:Security fix