Znode 9.9.0.F Patch Release - July 6, 2026

Highlights

This patch release includes security enhancements and minor bug fixes to improve platform stability and protect against known vulnerabilities.

Release Information

Znode 9.9.0.F patch release includes a couple of minor bug fixes.

Important Information and Breaking Changes

Other Breaking Changes

There are no breaking changes in this release.

Issues Resolved

[ZPD-34425] – AutoMapper Vulnerability Package Upgrade

Addressed a security vulnerability by upgrading the AutoMapper package to version 15.1.3. Required updates were made to the AutoMapper configuration and initialization process to ensure compatibility with the new version. Additionally, an environment variable and corresponding Web.config key were introduced to securely manage the AutoMapper license key.

[ZPD-34434] – Severe Vulnerability in Download PDF - LINQ Injection and Server-Side JavaScript Execution

Resolved critical security vulnerabilities in the PDF download functionality by upgrading the NReco.PdfGenerator package to version 1.2.1. Security improvements include authorization enforcement on DownloadPDF endpoints, sanitization of user inputs before LINQ processing, and disabling JavaScript execution during HTML-to-PDF conversion to mitigate injection and execution risks.

Implementation Details

[ZPD-34425] – AutoMapper Vulnerability Package Upgrade

Changes were implemented across multiple applications and libraries to support AutoMapper version 15.1.3:

• Znode.BStores.Api - AutoMapperConfig.cs
• Znode.Engine.CommercePortal.Api - AutoMapperConfig.cs, Global.asax.cs, Web.config
• Znode.Engine.Services.Contract - AutoMapperContractConfig.cs
• Znode.Admin.Core - AutoMapperConfig.cs
• Znode.Api.Core - AutoMapperConfig.cs, PublishProductCache.cs
• Znode.Libraries.Data - EntityAutoMapperExtension.cs
• Znode.Libraries.ECommerce.Utilities - Translator.cs, ZnodeDependencyResolver.cs
• Znode.WebStore.Core - AutoMapperConfig.cs
• Znode.Engine.Admin - MapperConfig.cs, Global.asax.cs
• Znode.Engine.Api - MapperConfig.cs, RestApiAutoMapperConfig.cs, Global.asax.cs
• Znode.Engine.WebStore - MapperConfig.cs, Global.asax.cs
• Znode.Multifront.PaymentApplication.Api - AutoMapperConfig.cs, Global.asax.cs
• Znode.Multifront.PaymentApplication.Helpers - Translator.cs

[ZPD-34434] – Download PDF Security Vulnerability Fix

The following files were updated to remediate LINQ Injection and Server-Side JavaScript Execution vulnerabilities:

• OrderService.cs
• OrderController.cs (Znode.Admin.Core)
• UserController.cs (Znode.WebStore.Core)