FreeCAD 1.1.4 fixes two security issues in file handling

Picture a supplier sending an FCStd file at 4:48 on Friday. The drawing is open on the second monitor, the coffee is cold, and someone needs one more face checked before the shop closes. Opening another FreeCAD project feels routine. That small click is the reason 1.1.4 matters.

FreeCAD released version 1.1.4 on September 28, 2026. It is a maintenance release with no new features, but skipping it because the toolbar did not change would miss the point. The FreeCAD News announcement says the update fixes more than 30 bugs. The tagged GitHub release, published at 13:58 UTC that day, calls it the last planned maintenance release in the 1.1.x series at the time.

What FreeCAD 1.1.4 fixes#

The GitHub release notes name two security fixes for file handling. FreeCAD says they can be triggered by opening a maliciously crafted FCStd file, and that all previously released versions are affected. Its recommendation is plain: all users should upgrade, especially people who open files from unknown or untrusted sources.

The change list identifies the affected code paths. PR #32980 hardens ZIP extraction in FEM. PR #33019 fixes Zip Slip in VRML texture loading. Those titles explain why the release note describes the issue as file handling rather than a flaw in a modeling operation.

Zip Slip is a class of path-traversal bug in archive extraction. Snyk's explanation describes how an archive entry that is not checked correctly can target a file outside the intended extraction folder. That is the general vulnerability pattern. FreeCAD's release note does not give CVE IDs, a severity score, or a FreeCAD-specific impact description, so I would not turn its update notice into a claim about a particular exploit outcome.

The same release has ordinary stability fixes too. FreeCAD's announcement says the broader patch set is concentrated in TechDraw, BIM, and the interface, and calls out a Part crash fix for files with faulty geometry. Helpful, but the security update is the reason I would install it promptly.

What to do before the next file handoff#

If your workstation runs a pre-1.1.4 version, install the updated stable release before opening FCStd files from outside your team. This is especially relevant when a supplier, customer, or unfamiliar download sends you a project you did not create. FreeCAD's official downloads page is the place to get its builds; the GitHub release also lists the 1.1.4 assets and notes that Windows and macOS builds are signed by the FreeCAD Project Association.

If you cannot update a machine yet, keep that older installation away from untrusted FCStd files until you can. A different exchange format may fit a quick geometry review, but it is not a general security guarantee; every importer has its own file-handling code.

For teams using FreeCAD with AI add-ons, our FreeCAD AI plug-in overview covers that separate workflow. This release concerns files opened by FreeCAD itself. It is also separate from whether a cloud text-to-CAD service retains prompts or geometry, which we cover in our design-data safety guide.

A maintenance release can be the important one#

The project has not announced a new modeling trick here. It has told FreeCAD users that every previous release has two file-handling vulnerabilities and urged them to update before opening untrusted projects. That's enough. CAD work depends on files from other people, and a file reader is part of the workflow whether or not anyone puts it in the demo.

I would put 1.1.4 on the update list before the next supplier model lands in Downloads. The feature count is zero. The risk from an outdated file reader is the part worth paying attention to.