After a couple of quick turnaround releases, this one is a normal maintenance release. A rebuilt thumbnail editor, one security fix worth moving on, and a long list of bugs that are now gone.
Concrete CMS 9.5.5 Is Available
Oct 14, 2026
by
The Thumbnail Editor Is Updated
Crop controls, a live preview so you can see what you're actually going to get, and a cleaned up dialog. If you've been cropping thumbnails by trial and error and re-uploading when they came out wrong, this is the fix.
Security
One advisory in this release, CVE-2026-106551, rated 8.6 on CVSS 4.0. That's high enough to move it up your list. Details are in the release notes.
If You Upgraded to 9.5.4
Page List blocks set to "Everywhere" on the homepage stopped returning results in 9.5.4. That's fixed.
Fixes Worth Calling Out
The calendar bug is the one to know about. Copying a calendar event that was associated with a page and then deleting the copy would delete the page, which orphaned the original event's page relation. Gone now.
Installing Concrete through Composer was impossible with security auditing enabled because of upstream dependencies, and concretecms/monolog-cascade wasn't compatible with symfony/config 6.4.44. Both sorted.
The rest of the list: the Legacy Form block errored on submit, the Add Workflow dashboard page threw a PHP 8 error, updating a Google Maps block programmatically could wipe the API key, deleting page attributes left a stale search index, the Redis cache driver couldn't delete all keys, and the dashboard favorite icon stayed gray in dark mode. The REST API got a batch of its own, including blocks no longer updating twice and image block links saving properly. Content Import Format got a similar sweep.
Smaller Improvements
The dashboard panel remembers when you close it and stays closed. Completed tasks stop showing as running. The Home Folder is pre-selected when you upload files from a block. File dialogs say "Invalid file" instead of throwing a fatal error when fID is empty or non-numeric. Express dashboard pages have better breadcrumbs. And you can now exclude system pages from the Remove Old Page Versions task.
For Developers
Packages that define tasks no longer need to explicitly register their task controllers with the task manager. The new ConcreteFetch JS library picked up improvements, and date_public is now on the Page API transformer. Beyond that, a lot of code cleanup, a batch of previously skipped tests brought back, and updated Composer dependencies.
Getting It
SaaS hosting is already updated. Self-hosted sites can download 9.5.5 or update through Composer. The full 9.5.5 release notes have every change.
Maslowski, S. (n.d.). Indigo bunting [Photograph]. U.S. Fish and Wildlife Service. Public domain. https://www.fws.gov/media/ingigo-bunting