Zender - WhatsApp and SMS Messaging Platform and use Android as SMS Gateways (SaaS) v3.11.7

2026-10-24

Changelog v3.11.7

Updated the bundled nginx rules. If your server runs nginx and includes the .nginx.conf file, reload nginx after updating so the new rules apply. If you copied its contents into your own server configuration instead, copy the new rules across and reload nginx. Until then, the extra protection for the uploads folder is not active on nginx.
Fixed a security issue with files received over WhatsApp: only common image, video, audio, PDF, Office, text and CSV files keep their original type, and any other file is now saved as a generic .bin file.
Fixed a security issue in the uploads folder: files stored there can no longer be run as programs on Apache servers, including requests that append extra text after the file name.
Fixed a security issue when creating or editing WhatsApp auto-replies.
Improved the bundled WhatsApp server so received documents are only saved under a known file type.