This release note lists the features, improvements and fixes in this version. Release dates per version are published in the Evaluation release schedule.
Security
An integral part of our development and build process is the automatic scanning for known security vulnerabilities. Fixes are prioritised based on impact: some may require an immediate hot-fix, while others are addressed in the current or next Sprint (release). For more information on reported vulnerabilities, see the central database of vulnerabilities.
Security hotfix PHP vulnerability in SPSS export - EV-457
The SPSS export in Evaluation runs in a separate component, and is the only part of Evaluation built on PHP.
On October 21, 2026, PHP reported and published fixes for two critical vulnerabilities (CVE-2026-109618 (9.2) and CVE-2026-109619 (9.2)), which can allow remote code execution on servers running PHP. As a precaution, we made the SPSS export unavailable on October 21 on all systems.
The component has been updated with the fixes for both vulnerabilities. In addition, the component now ignores uploads and form data it never uses, which further limits the reach of an incoming request. The SPSS export has been made available again as of October 22.
An analysis of the available logs showed no signs the vulnerabilities were used. The risk was already limited since the SPSS exporter (and thus the PHP code) could only be reached from within the TimeEdit platform, not directly from the internet.
While the SPSS export was unavailable, users who tried to export to SPSS received an error message.
Security improvement - EV-474
An analysis of all API services and their API calls learned the Evaluation detail endpoint was exposing too much details. This conflicts with the Principle of Least Privilege (PoLP), and the not really necessary information is no longer exposed. The information exposed will based on PoLP adjust itself to the requesting service.
Improvements
New functionality, user experience refinements, and bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.
As an administrator I want to search on question code in question management - EV-456
The search for questions in the question management (administrator) menu was using full-text search on the question title. There was no support for direct searching for a specific question on the unique question code. The search is enriched with support for question code, and searching on code or a term in the title is both supported.
As an administrator I should be able to delete Report templates - EV-470
On the Report templates page a Report template could not be deleted, in case reports had been made with the template. A change is made to enable deleting such a template, where the delete also includes the exports that were made with it, together with their generated files offered for download.
In case one of its exports is still waiting or running, the template is not deleted and a message asks you to try again once the export has finished.
The Downloads list and the Exports page load faster - EV-460
For institutions with many downloads, the Downloads list and the Exports page now load noticeably faster. Downloads keep their place in the list, so a list that was open while the new version was installed still points at the right files.
Survey settings should be respected for External Examiner in Curriculum - EV-463, EV-415 (Hotfix)
An evaluation type has several settings that change how its survey looks and works for participants. You can find them under Admin, Evaluation types: Sidebar navigation, Hide submit page, Show answers after completion, Show question breadcrumbs extended, and the type's own Style. These settings were applied in the admin preview and evaluations directly run from Evaluation.
However, for evaluations run within Curriculum (External Examiner) the settings were not correctly used for participants filling in the survey. In fact, they always saw the default survey. This has been fixed, and participants now get the survey as the evaluation type is configured.
For the evaluations using an evaluation type using one or more of these setting, the participants will see the survey change with this release. E.g. if sidebar navigation is set, participants can move between the question blocks by clicking them in the sidebar, as intended for External Examiner evaluations.
Next to this change, a few smaller improvements are applied:
- On the Check and submit page, Show my answers now lists only the questions the participant answered. Before, it also listed unanswered questions, information texts and images, and blocks that did not apply to the participant, such as a lecturer they had not selected, and number answers were shown empty.
- With Hide submit page switched on, the survey could stay empty for a participant who reloaded it after the number of pages had changed, for example because the setting was switched on while they were filling it in, or when none of the question blocks applied to them. The survey now opens on the last available page.
- In the sidebar, the number of unanswered required and optional questions on a page now also appears when you reach the page with the keyboard, and Escape closes it.
- On small screens, the button that opens and closes the sidebar is now read out by screen readers in the language of the survey.
See the Evaluation manual for configuration guidance.