Release notes.

Folder uploads & instant upload

• Folder uploads keep their structure. Folder drops and directory-picker selections carry each file's relative path through the upload and expose it server-side as e.RelativePath (traversal-sanitized), so your handler can recreate the tree. New WebkitDirectory control property enables the directory picker.
• Instant upload (content dedupe). Opt-in: the client hashes the file with SHA-256 and, when the server already stores that exact content, the upload completes instantly with zero bytes transferred. The server hashes content itself — client-claimed hashes are never trusted.

Web Forms compatibility

• Legacy controls post back automatically again. The CuteWebUI:Uploader and CuteWebUI:UploadAttachments compatibility controls now auto-post-back when the batch finishes, so upgraded 4.x pages fire FileUploaded / AttachmentAdded with no submit button — exactly as they did in 4.x.
• Attachment post-data now parses the client's comma-separated GUID list, so AttachmentAdded and the Items collection populate reliably.
• VB.NET demo coverage added for the save pattern, multiple files, folder drop, and server-side validation.

5.2.3 — security update Recommended for all users

This release fixes security issues in the upload pipeline. Upgrading is recommended for every deployment. The control assembly remains v5.3.0; the release package is 5.2.3.

• Chunked-upload validation bypass. Validation ran only on the first chunk and never at completion, so a client that skipped chunk 0 — or renamed the file in the completion call — could store a file whose extension, MIME type and size were never checked. Validation now runs on every chunk, at completion, and against the real assembled size.
• Cross-site scripting via file names. Toast notifications and several queue/preview elements inserted file names and server error text as markup, so a hostile file name could execute script. These are now escaped or inserted as text.
• Unbounded disk writes. Chunk uploads were not size-capped and tus PATCH was not clamped to the declared Upload-Length, letting one client fill the disk. Both are bounded now, and abandoned tus sessions are cleaned up.
• Image-transform memory exhaustion. ?w=/?h= on the download endpoint allocated without an upper bound; dimensions are now clamped before allocation.
• Script-block escaping in the server controls hardened, and files larger than 2 GB no longer overflow in the legacy compatibility controls.
• Error detail no longer echoed to clients.

Cloud sources

• Box promoted to a first-class source.
• Unsplash search-and-import source added.
• Companion broker: self-hosted Node OAuth plus file proxy (Dropbox, Box, Drive, OneDrive) with proxy and server-to-destination transfer modes.

Headless framework hooks

• useUploader() for React and Vue.
• use:uploader Svelte action.
• UploaderService for Angular.

Image editor

• Content-aware smart-crop (edge-energy focal point - not AI).
• Text and sticker overlays with styling controls.
• Filter adjustments (brightness, contrast, saturation, sepia, grayscale) plus presets.
• EXIF metadata viewer and crop-ratio chips.
• AVIF and WebP output with a quality slider.

Image pipeline

• EXIF auto-rotate on upload.
• PDF poster thumbnails.
• URL-based transforms: transformUrl client helper, honored server-side via GDI+ on Web Forms.

Validation and UX

• Standalone aspectRatio validator and per-file rename UI.
• Restore prompt to resume incomplete uploads after reload.
• Whole-page drop target, form auto-attach, locale auto-detect.
• Accessibility: ARIA live-region announcements, reduced-motion support, focus traps.
• 28 built-in locales.

Server / .NET

• GCS server endpoints and IGcsSigner.
• IImageTransformer extension point on CoreUpload.