9.5.4 Release Notes

Behavioral Improvements

Test mail settings: show email sender, add links to configuration pages (#13078) (thanks mlocati)
SEO bulk report no longer rescans paths needlessly for every page it lists. (#13071)
Improve sanitization checking of SVG on upload

Fix issue with composer attribute control not saving
When dragging / dropping page in sitemap an "invalid token"-error occurs (#13077)
Rescan Locale strips every content-block page link and crashes on stack pages (#13082) (thanks janscarton)
Mail Service: From and Subject headers are still encoded on the dashboard logs page (9.5.3) (#13075) (thanks broreece)
Express object dashboard: validation failure returns a 500 instead of an error (#13093)
Express object dashboard: delete_entries() has no permission check (#13095)
[Bug] Translate Site Interface “Save to file” fails with “Invalid language identifier” on a non-default site (#13065)

CVE-2026-85385 (Risk Rank 7.7) (thanks Suraj Bhosale)
CVE-2026-85386 (Risk Rank 7.3) (thanks Valentin SARRE (Independent security researcher))
CVE-2026-85387 (thanks Myq Larson)
CVE-2026-87028 (Risk Rank 5.3) (thanks Pakung)
CVE-2026-87031 (Risk Rank 2.1) (thanks Winston Crooker)

Fix the documented types of the attribute value objects (#13079) (thanks mlocati)
Removed some vestigial code (thanks mlocati)