---
title: Portfolio 4 Release Notes - Extensis.com
---

[![Extensis](https://www.extensis.com/hubfs/brand/extensis-monotype/Extensis_aMonotypecompany_Coral_Dark.svg "Extensis")](https://www.extensis.com?hsLang=en)

## Portfolio 4

Release Notes

#### System Requirements are [here](https://www.extensis.com/support/portfolio-4/system-requirements/?hsLang=en).

#### Current version

- Portfolio: 4.0.1
- Media Engine: 4.0.1
- Web Client: 4.0.1
- Desktop Client: 4.0.1

### Version 4.0.1

#### What’s new

- Server: We updated Apache Tomcat to version 9.0.58.
- Server: We updated the log4j library to version 2.17.2. This eliminates a vulnerability introduced in earlier versions of the log4j library as detailed here: [https://www.cve.org/CVERecord?id=CVE-2021-44228](https://www.cve.org/CVERecord?id=CVE-2021-44228).
- We addressed five high-risk flaws identified by [White Oak Security](https://www.whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/):
  
    - Admin/Web/Desktop: Authentication Bypass – Hard-Coded Credentials ([CVE-2022-24255](https://www.cve.org/CVERecord?id=CVE-2022-24255))
    - Web: Authenticated Unrestricted File Upload Resulting in Remote Code Execution ([CVE-2022-24251](https://www.cve.org/CVERecord?id=CVE-2022-24251))
    - Web: Authenticated Unrestricted File Upload + Path Traversal Resulting in Remote Code Execution ([CVE-2022-24252](https://www.cve.org/CVERecord?id=CVE-2022-24252))
    - Admin: Authenticated Archive Zip-Slip Path Traversal Resulting in Remote Code Execution ([CVE-2022-24254](https://www.cve.org/CVERecord?id=CVE-2022-24254))
    - Admin: Authenticated Unrestricted File Upload Resulting in Remote Code Execution ([CVE-2022-24253](https://www.cve.org/CVERecord?id=CVE-2022-24253))

#### Known issues

- The change that addresses the security issue CVE-2022-24252 may cause Web Client scripts to fail. If your Web Client scripts stop working, see [this article](https://help.extensis.com/hc/articles/5476335356955).

### Version 4.0.0

#### What’s new

- Server: Portfolio now supports Active Directory 2019.
- Web, Desktop: You can now share private galleries with other users.
- Server: You can now turn off the English option when you choose another language in the General Engine section of the Smart Keywords settings.
- Web, Desktop: We have updated NetPublish Site Builder to allow you to add any number of metadata fields to be published. (You should confirm that your chosen fields will display as expected.)
- NetPublish: We have increased the space available for details in the asset preview available on a NetPublish site.
- NetPublish: In NetPublish Site Builder, you can allow site visitors to choose among multiple formats when they download assets.
- NetPublish: We have improved watermarks created by NetPublish to include a white shadow for black text, and a black shadow for white text.
- NetPublish: In NetPublish Site Builder, we have added an option for what a visitor can do when they try to download a file that can’t be watermarked.
- Server: We updated LibRaw to version 0.20.2.
- Server: We updated Apache Tomcat to version 9.0.43.

#### Bug fixes

- We fixed an issue where a long field name was cut off when you added it to your site’s Grid Fields in the NetPublish Site Builder. [PORT-12930]
- We fixed an issue where the NetPublish Usage report would display user names incorrectly. [PORT-13127]
- We fixed an issue where Portfolio would remove a deleted asset from the Asset Deletion report after a few days, no matter what the date range for the report is. [PORT-13349]
- We fixed an issue where a catalog created while logged in using a language other than U.S. English would display EXIF and GEO metadata fields in the wrong category in the client. [PORT-13354]
- We fixed an issue where Portfolio couldn’t create a catalog with the General Use template when the user logged in with the International English language. [PORT-13365]

**[Privacy Policy](https://www.extensis.com/privacy-policy?hsLang=en) // [Data Transfer Agreement](https://www.extensis.com/data-transfer-agreement?hsLang=en) // [Terms Of Use ](https://www.extensis.com/terms-of-use?hsLang=en)**

© 2025 Monotype Imaging Inc. All rights reserved.