CapaInstaller Changelog

Find a version

All versions

Version [6.7.109] - 2026 Latest

Release summary

This release contains security fixes, and we recommend that you carry out the update more quickly than for a regular maintenance release. This is not a critical operational situation, but the release addresses identified security issues that, under certain circumstances, could increase the risk of unauthorized access or misuse of the system.

Added

• Optimized disk partitioning – Microsoft-recommended layout — CapaInstaller now supports the Microsoft-recommended partition layout for UEFI-based devices when deploying Windows, creating the four required partitions (System/EFI, MSR, Windows, and Recovery) in the correct order with the correct sizes and file systems. This results in more robust installations, better support for Secure Boot and BitLocker, and ensures your setup is ready for future Windows updates.

Fixed

• Package Status Views now load correctly — an issue that prevented the view from displaying package status data has been resolved.

Security

CapaInstaller 6.7.109 fixes the following vulnerabilities, which affect CapaInstaller 6.7.108 and earlier. We recommend upgrading CapaInstaller, including its agents, to 6.7.109 or later.

The vulnerabilities were reported through responsible disclosure by Filip Magic and Christoffer Olsen of the TDC NET Security Testing & Advisory team.

• Authentication bypass in CiBaseAgent (CWE-288) — A remote attacker could access protected CiBaseAgent endpoints without authentication and read sensitive data such as file job logs. Fixed in CapaInstaller Agents 6.7.259.109 and included in CapaInstaller 6.7.109.
• External control of file paths in CiBaseAgent file transfer (CWE-73) — An attacker could read and write files in a limited set of server-side folders, which affected device inventory data. Fixed in CapaInstaller Agents 6.7.259.109 and included in CapaInstaller 6.7.109.
• Stored cross-site scripting in the CiBaseAgent log viewer (CWE-79) — Fixed in CapaInstaller Agents 6.7.259.109 and included in CapaInstaller 6.7.109.
• Reflected cross-site scripting in CiFrontEnd and CiBackEnd (CWE-79) — Fixed in CapaInstaller (Core) 6.7.294.109 and included in CapaInstaller 6.7.109.