Release notes.

5.2.3 — security update Recommended for all users

This release fixes security issues in the upload pipeline. Upgrading is recommended for every deployment. The control assembly remains v5.2.0; the release package is 5.2.3.

• Chunked-upload validation bypass. Validation ran only on the first chunk and never at completion, so a client that skipped chunk 0 — or renamed the file in the completion call — could store a file whose extension, MIME type and size were never checked. Validation now runs on every chunk, at completion, and against the real assembled size.
• Cross-site scripting via file names. Toast notifications and several queue/preview elements inserted file names and server error text as markup, so a hostile file name could execute script. These are now escaped or inserted as text.
• Unbounded disk writes. Chunk uploads were not size-capped and tus PATCH was not clamped to the declared Upload-Length, letting one client fill the disk. Both are bounded now, and abandoned tus sessions are cleaned up.
• Image-transform memory exhaustion. ?w=/?h= on the download endpoint allocated without an upper bound; dimensions are now clamped before allocation.
• Script-block escaping in the server controls hardened, and files larger than 2 GB no longer overflow in the legacy compatibility controls.
• Error detail no longer echoed to clients.

Cloud sources

• Box promoted to a first-class source.
• Unsplash search-and-import source added.
• Companion broker: self-hosted Node OAuth plus file proxy (Dropbox, Box, Drive, OneDrive) with proxy and server-to-destination transfer modes.

Headless framework hooks

• useUploader() for React and Vue.
• use:uploader Svelte action.
• UploaderService for Angular.

Image editor

• Content-aware smart-crop (edge-energy focal point - not AI).
• Text and sticker overlays with styling controls.
• Filter adjustments (brightness, contrast, saturation, sepia, grayscale) plus presets.
• EXIF metadata viewer and crop-ratio chips.
• AVIF and WebP output with a quality slider.

Image pipeline

• EXIF auto-rotate on upload.
• PDF poster thumbnails.
• URL-based transforms: transformUrl client helper, honored server-side via GDI+ on Web Forms.

Validation and UX

• Standalone aspectRatio validator and per-file rename UI.
• Restore prompt to resume incomplete uploads after reload.
• Whole-page drop target, form auto-attach, locale auto-detect.
• Accessibility: ARIA live-region announcements, reduced-motion support, focus traps.
• 28 built-in locales.

Server / .NET

• GCS server endpoints and IGcsSigner.
• IImageTransformer extension point on CoreUpload.