Piler security fixes

[Security] piler-smtp 1.1.7

Sun, 18 Oct 2026 00:00:00 +0000

Security

Improved verification of the licensed hostname.

Fixed

In multi-tenant mode, a recipient piler-smtp rejects gets a permanent error (550) instead of a temporary one, so the sending server doesn't keep retrying it.

[Security] piler-ee 2.2.4

Sat, 17 Oct 2026 00:00:00 +0000

2.2.3 was not released; its changes are included here.

Added

Outlook add-in (off by default, OUTLOOK_ADDIN_ENABLED): search the archive, preview a message, read the full message and restore it to the mailbox from Outlook on the web, new Outlook for Windows, classic Outlook and Outlook for Mac. Served by piler-ui itself; the add-in asks Outlook for the lowest permission and reads nothing of the mailbox. See Outlook add-in.
Bcc recipients from the SMTP envelope: piler-smtp can write the envelope of each email to an envelope file (enable_envelope_sidecar), and the envelope recipients are archived like the To and Cc ones, so a Bcc recipient finds the email. A copy of an email delivered in another SMTP transaction adds its recipients to the archived email (ENVELOPE_MERGE_WINDOW_HOURS). See Envelope recipients.
Envelope sender: recorded for each email; auditors see it in the message view, with a warning when it differs from the From header, and can search by it (mailfrom:, "Envelope sender" field).
EXTRA_RECIPIENTS_HEADER: archive the addresses of a header added by the MTA or the journaling setup (e.g. X-Envelope-To) as recipients.
ARCHIVE_MESSAGE_VARIANTS: a message with the Message-ID of an archived one but different content is archived as a message of its own instead of being dropped as a duplicate. Auditors see the other messages with the same Message-ID as related copies, also across the nodes of a multi-node setup.
pilerimport and Bcc recipients of migrated mail: an envelope file next to an EML (message.eml.env) adds its recipients; -add-recipients (with -dry-run) adds them to mail imported earlier, without importing it again. Every message that gets recipients has an audit log entry, also sent to the SIEM when SIEM export is enabled.
POST /api/v1/message/lookup: find an archived message by its Message-ID, also on the master of a multi-node setup.

Security

Per-message access checks extended to exports, similar messages, related attachments, bulk removal and message categories, matching the checks of search and the message view.
API access tokens carry the user's category and group restrictions, so API clients and multi-node workers see the same messages as the web UI.
AI thread summaries only include, and only share between users, the messages of the thread the user may see.
A removed message (by the user, a data officer or a GDPR erasure) stays out of the search until it's purged, also when a copy of it arrives again or pilerimport processes it.
pilerimport installed setuid takes its configuration only from its protected configuration file, not from the caller's environment.
API requests with a Bearer token no longer create a server-side session.

Changed

pilerimport honours ARCHIVE_MESSAGE_VARIANTS and SPAM_HEADER_LINE like the piler daemon.
The "Top Attachment Types" analytics widget is labelled as a cumulative total of all archived attachments.
More data-* customization hooks on the Search and Audit Log pages; accessibility and HTML markup fixes.
Upgraded frontend dependencies (Vue, axios, DOMPurify).

Fixed

Duplicates left an orphaned encrypted message file in the store (and in the S3 bucket); new duplicates no longer do.
A message whose search index write failed stayed archived but unsearchable; a later copy of it now restores its index entry.
Copies of a message arriving at the same moment could both be archived.
Ingest deadlocks between the analytics sync and concurrent archiving (e.g. pilerimport failing with "Deadlock found").
Emails whose To header lists several addresses inside one pair of angle brackets ended up in the error directory; an unusable address in To/Cc is now skipped and logged instead of failing the email.
IMAP logins with Mailcow lost the user's local group addresses.
Multi-node: removal requests and the data officer's approval or rejection now take effect on the worker that has the message; restore and the message view report the worker's errors instead of returning an empty or wrong result.
The thread indicator could be missing for regular users in long threads.
A purged message answers "the message has been purged" instead of an error.
Upgrading from 1.x: migration 005 failed with "Illegal mix of collations" on some MariaDB versions, and the deb package left the obsolete 1.x configuration files behind, blocking the piler-smtp installation.

[Security] piler-smtp 1.1.4

Wed, 07 Oct 2026 00:00:00 +0000

Added

Envelope files (enable_envelope_sidecar, off by default): the envelope of each email is written to a .env file next to it, with the envelope sender and the envelope recipients encoded in the archive address (<tenant>+<local part>=<domain>@<archive host>), so that Bcc recipients can be archived. See Envelope recipients. Needs Piler Enterprise 2.2.4 or later.

Security

Hardened the SMTP input handling: limits on lines without a line ending, correct handling of BDAT chunks (with enable_chunking=1), bare LF line endings and NUL bytes in the message.

[Security] piler-ee 2.2.2

Tue, 22 Sep 2026 00:00:00 +0000

Security

Upgraded grpc and go.opentelemetry.io/otel to address CVE-2026-84304 and related CVEs

Added

Per-message delete action in the preview pane
Stable HTML customization hooks (data-* attributes) for MSP frontend integration
Multi-node support for user email purge

Changed

piler-ui Docker image build simplified to a prebuilt-binary copy (matches the pattern later applied to the scanner image)
Manticore search engine upgraded to 29.9.0
Message selection: Ctrl/Cmd+click for single-message selection, Shift+click for range selection

Fixed

Table content clipping in dashboard cards
Bogus sort order in multinode search results
Regular users seeing 0 search results in multinode mode
Timezone validation failing on Alpine runtime images (IANA tzdata now embedded rather than relying on the host OS)
Unmounted Vue templates briefly flashing placeholder content (v-cloak)
Trailing boundary CRLF in attachment MIME parts incorrectly flagged as invalid
False-positive attachment size mismatch logging for base64-encoded attachments
S3 promotion window returning an empty 200 instead of 503

[Security] piler-ee 2.2.1

Sun, 06 Sep 2026 00:00:00 +0000

Security

Upgraded nanoid to 3.3.18 to fix CVE-2026-67213 (high severity)

Added

S3_SKIP_EXISTING_OBJECTS to skip re-uploading objects already present across nodes
S3_PART_SIZE_MB and S3_DISABLE_MULTIPART knobs for s3uploader
purge --restore-id for restoring a specific prior purge run; PACKAGES.md documenting package build/signing

Changed

Dockerfiles upgraded to alpine:3.24; audit log table gained stable CSS identifiers for MSP customization
RPM_RELEASE override for RPM packaging; fixed dpkg-sig removal on package updates

Fixed

Fixed a tenant-configuration bug that could cause scheduled purges to be skipped
Nested-multipart attachments misindexed in pilerimport; mismatched download objects now caught explicitly
Five distinct archiving bugs: duplicate detection, purge tombstone handling, From header overflow, enable_purge flag handling, and an attachment-processing race condition
Purge command: tombstone restore, recipient preservation, dry-run loop behavior, missing-env-var warning

[Security] piler-ee 2.1.5

Sun, 26 Jul 2026 00:00:00 +0000

Security

grpc bumped to v1.82.1 to fix security vulnerabilities
gofiber and golang.org/x/net upgraded (security-motivated)
dompurify 3.4.11 → 3.4.12

Added

Pending conversations: badge in search results plus a dedicated drawer for messages awaiting a reply
Attachment indexing gated on TIKA_URL being configured, rather than always-on
Explicit Dependabot workflow for automated dependency PRs
Standby-node support for import jobs; multi-node import handling
Theme and accent-color support carried over from EAM authentication

Changed

Build tooling switched from the previous bundler to Vite (and bumped several times through the 6.4→8.1 series as issues were found); iframe session cookie set to SameSite=None for embedding scenarios; listens for a postMessage theme-change event from a parent iframe
Import job handling simplified

Fixed

Email direction now computed per-message from the local domain table, rather than a possibly-stale cached value
c.IP() captured before entering a goroutine in ZipAndStreamDownloadRemote (was reading a request-scoped value after the request had already returned)
Multi-node export; mobile screen layout issues; vendor CSS handling under the Vite build; header parser edge case; several import/migration fixes; purge logging

Dependencies

Routine bumps: vue 3.5.38→3.5.39, postcss 8.5.16→8.5.23, axios 1.18.0→1.18.1, @vitejs/plugin-vue 5.2.4→6.0.7, plus a batch of GitHub Actions version bumps (actions/checkout, actions/setup-go, actions/setup-python, actions/upload-artifact, actions/download-artifact, docker/setup-buildx-action, docker/setup-qemu-action, docker/login-action, docker/metadata-action, softprops/action-gh-release)

[Security] piler-ee 2.1.2

Sun, 15 Mar 2026 00:00:00 +0000

The largest release in this window - unified archiving for chat platforms, GDPR right-to-erasure, passkey authentication, multi-master-node HA, and a round of gosec-driven security hardening.

Security

Passkey (WebAuthn) authentication support added
gosec static-analysis fixes applied across reindex, imapimport, pilerimport, and s3uploader
TLS support added for the MySQL connection
Added additional iframe-embedding security headers
Sensitive SIEM connection details no longer appear in logs

Added

Slack and Microsoft Teams collectors: initial unified-archiving support for chat platforms, including a parallelized Slack collector and dedicated UI/API components
GDPR Right to Erasure: multi-node-aware implementation
Find similar messages: KNN vector search over message embeddings
Multi-master-node support (previously single-master architecture)
IMAP import checkpoint/resume support: connection details and progress are persisted so long-running imports can resume after an interruption
Swagger/OpenAPI documentation for the admin API
Attachment search, with flat mode made the default
SEMANTIC_SEARCH_ONNX_THREADS configuration option
SIEM Sumo Logic support

Changed

Metadata/attachment inserts now use a database transaction
ediscovery exports now emit an audit log entry
Purge performance improvements

Fixed

Deb packaging issue; API auth edge case; cron entry handling; various migration/import fixes

Dependencies

gofiber/fiber bumped in contrib/external-jwt-shared-secret; go.opentelemetry.io/otel/sdk 1.36.0 → 1.40.0; gofiber/fiber 2.52.11 → 2.52.12; filippo.io/edwards25519 1.1.0 → 1.1.1