diff --git a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12.tar.gz b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12.tar.gz
deleted file mode 100644
index 41abc7470..000000000
Binary files a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12.tar.gz and /dev/null differ
diff --git a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12_all.deb b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12_all.deb
deleted file mode 100644
index 1a85c5b75..000000000
Binary files a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12_all.deb and /dev/null differ
diff --git a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12_amd64.changes b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12_amd64.changes
deleted file mode 100644
index 1acde791d..000000000
--- a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12_amd64.changes
+++ /dev/null
@@ -1,53 +0,0 @@
-Format: 1.8
-Date: Tue, 15 Sep 2026 21:19:14 +0200
-Source: linuxmuster-webui7
-Binary: linuxmuster-webui7
-Built-For-Profiles: noudeb
-Architecture: source all
-Version: 7.4.12
-Distribution: lmn74
-Urgency: medium
-Maintainer: Arnaud Kientz <arnaud@linuxmuster.net>
-Changed-By: Arnaud Kientz <arnaud@linuxmuster.net>
-Description:
- linuxmuster-webui7 - Next generation web-based management tool for linuxmuster.net v7.
-Changes:
- linuxmuster-webui7 (7.4.12) lmn74; urgency=medium
- .
-   * [lmn_settings] An API key can be restricted to a list of endpoints,
-     the scope added in linuxmuster-api 7.4.13. Entries are added and
-     removed from the key dialog, and the dialog documents the syntax and
-     its wildcards. Leaving the scope empty keeps the current behaviour: a
-     key reaching the whole API with the permissions of its user.
-   * [lmn_settings] Saving the API keys no longer drops the fields this
-     tab does not know about: keys are merged into the ones already in the
-     API's config.yml instead of replacing them wholesale, which silently
-     discarded the scope of every key at once.
-   * [lmn_settings] A failed restart of linuxmuster-api is reported
-     instead of being swallowed. The service only reads the keys at
-     startup, so until it is restarted the change just saved is not
-     active.
-   * [packaging] postinst: the deprecated venv migration is dropped, and a
-     system-wide Ajenti is uninstalled on install and upgrade. pip skips
-     in a --system-site-packages venv any requirement the system already
-     satisfies, pinned versions included, so a system-wide copy kept the
-     venv from ever owning its own and no update would have touched it
-     again.
-   * [packaging] New linuxmuster-venv dpkg trigger: when
-     linuxmuster-tools7 rebuilds the shared venv after a Python upgrade,
-     the webui reinstalls its requirements and restarts.
-Checksums-Sha1:
- ae7d3a86e2a36de73836fefb29757bc444841347 565 linuxmuster-webui7_7.4.12.dsc
- 9c65923c8722a6cc84144b8e1daa7c6335459498 1631774 linuxmuster-webui7_7.4.12.tar.gz
- ce6b426e80cef5a38238e955c2a96074fb9f12f7 838894 linuxmuster-webui7_7.4.12_all.deb
- 1019104bf4ed1bab4897c91b86e9016761da3942 7801 linuxmuster-webui7_7.4.12_amd64.buildinfo
-Checksums-Sha256:
- 49dfab5f8689af46da0495746c025ffd8ff1bb3f3e202e0535c0a9182a1dd46f 565 linuxmuster-webui7_7.4.12.dsc
- dae13634257c8677a03bb6cad9c11eb0550fd8e6b6108da326a16c078c06902d 1631774 linuxmuster-webui7_7.4.12.tar.gz
- fab3d5056dd34b1f647d7d71fc129951e3757e5aec427171efe7b4d0e51f2a1d 838894 linuxmuster-webui7_7.4.12_all.deb
- acb5d8b0d68036f3fa791f9a541310966eb5cfc9cabc77d43af626705e7795be 7801 linuxmuster-webui7_7.4.12_amd64.buildinfo
-Files:
- 71b7dcb72b7f50c8fa4742fb37f98728 565 admin optional linuxmuster-webui7_7.4.12.dsc
- f0da27ae9aa96f06cd4e03c49ed4bd2c 1631774 admin optional linuxmuster-webui7_7.4.12.tar.gz
- 2ab4319e36056a437f58438701994145 838894 admin optional linuxmuster-webui7_7.4.12_all.deb
- 3df95477fb5519b18b640b8be1b7d978 7801 admin optional linuxmuster-webui7_7.4.12_amd64.buildinfo
diff --git a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12.dsc b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13.dsc
similarity index 50%
rename from packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12.dsc
rename to packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13.dsc
index f7dcdc66b..55c16cb33 100644
--- a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12.dsc
+++ b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13.dsc
@@ -2,14 +2,14 @@ Format: 1.0
 Source: linuxmuster-webui7
 Binary: linuxmuster-webui7
 Architecture: all
-Version: 7.4.12
+Version: 7.4.13
 Maintainer: Arnaud Kientz <arnaud@linuxmuster.net>
 Build-Depends: debhelper (>= 4.0.0), fakeroot
 Package-List:
  linuxmuster-webui7 deb admin optional arch=all
 Checksums-Sha1:
- 9c65923c8722a6cc84144b8e1daa7c6335459498 1631774 linuxmuster-webui7_7.4.12.tar.gz
+ 1b0b9f9c960f3fa4c6f59768423405bcfebc45e2 1631690 linuxmuster-webui7_7.4.13.tar.gz
 Checksums-Sha256:
- dae13634257c8677a03bb6cad9c11eb0550fd8e6b6108da326a16c078c06902d 1631774 linuxmuster-webui7_7.4.12.tar.gz
+ 90fea307675b6a772c168977f0b6c5bad0ad591157d161ae7179165ea898c54e 1631690 linuxmuster-webui7_7.4.13.tar.gz
 Files:
- f0da27ae9aa96f06cd4e03c49ed4bd2c 1631774 linuxmuster-webui7_7.4.12.tar.gz
+ c3a79fe555bf0671eabd836404e4abdd 1631690 linuxmuster-webui7_7.4.13.tar.gz
diff --git a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13.tar.gz b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13.tar.gz
new file mode 100644
index 000000000..23d0da5a8
Binary files /dev/null and b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13.tar.gz differ
diff --git a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13_all.deb b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13_all.deb
new file mode 100644
index 000000000..43322a750
Binary files /dev/null and b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13_all.deb differ
diff --git a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12_amd64.buildinfo b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13_amd64.buildinfo
similarity index 86%
rename from packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12_amd64.buildinfo
rename to packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13_amd64.buildinfo
index 4bec54b03..ab93e3079 100644
--- a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.12_amd64.buildinfo
+++ b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13_amd64.buildinfo
@@ -2,19 +2,19 @@ Format: 1.0
 Source: linuxmuster-webui7
 Binary: linuxmuster-webui7
 Architecture: all source
-Version: 7.4.12
+Version: 7.4.13
 Checksums-Md5:
- 71b7dcb72b7f50c8fa4742fb37f98728 565 linuxmuster-webui7_7.4.12.dsc
- 2ab4319e36056a437f58438701994145 838894 linuxmuster-webui7_7.4.12_all.deb
+ 5a148f2dd5d19c26216973c440c14ed6 565 linuxmuster-webui7_7.4.13.dsc
+ d2fc3b76b959cefdeba970caf6b59325 840470 linuxmuster-webui7_7.4.13_all.deb
 Checksums-Sha1:
- ae7d3a86e2a36de73836fefb29757bc444841347 565 linuxmuster-webui7_7.4.12.dsc
- ce6b426e80cef5a38238e955c2a96074fb9f12f7 838894 linuxmuster-webui7_7.4.12_all.deb
+ 1fef5f382198f8e1ca1e01c56172fc7ce74b3a98 565 linuxmuster-webui7_7.4.13.dsc
+ 8ef87fe722b3cf1438fa7c34a78af6e39aebf958 840470 linuxmuster-webui7_7.4.13_all.deb
 Checksums-Sha256:
- 49dfab5f8689af46da0495746c025ffd8ff1bb3f3e202e0535c0a9182a1dd46f 565 linuxmuster-webui7_7.4.12.dsc
- fab3d5056dd34b1f647d7d71fc129951e3757e5aec427171efe7b4d0e51f2a1d 838894 linuxmuster-webui7_7.4.12_all.deb
+ 4a6eeb41234f9520a38e758da25a177f217b24ccff3d5c9e12833226ad558487 565 linuxmuster-webui7_7.4.13.dsc
+ 942cbf4872054f3aa1e1bc2c26e9ba51cccb92ddb2f6fb5fd09508ad32f3a24f 840470 linuxmuster-webui7_7.4.13_all.deb
 Build-Origin: Ubuntu
 Build-Architecture: amd64
-Build-Date: Tue, 15 Sep 2026 19:25:08 +0000
+Build-Date: Sun, 11 Oct 2026 08:45:09 +0000
 Build-Tainted-By:
  merged-usr-via-aliased-dirs
  usr-local-has-includes
@@ -89,16 +89,16 @@ Installed-Build-Depends:
  libasan8 (= 14.2.0-4ubuntu2~24.04.1),
  libatomic1 (= 14.2.0-4ubuntu2~24.04.1),
  libattr1 (= 1:2.5.2-1ubuntu0.1),
- libaudit-common (= 1:3.1.2-2.1build1.1),
- libaudit1 (= 1:3.1.2-2.1build1.1),
+ libaudit-common (= 1:3.1.2-2.1ubuntu0.1),
+ libaudit1 (= 1:3.1.2-2.1ubuntu0.1),
  libbinutils (= 2.42-4ubuntu2.10),
  libblkid1 (= 2.39.3-9ubuntu6.6),
  libbsd0 (= 0.12.1-1build1.1),
  libbz2-1.0 (= 1.0.8-5.1ubuntu0.1),
- libc-bin (= 2.39-0ubuntu8.8),
- libc-dev-bin (= 2.39-0ubuntu8.8),
- libc6 (= 2.39-0ubuntu8.8),
- libc6-dev (= 2.39-0ubuntu8.8),
+ libc-bin (= 2.39-0ubuntu8.9),
+ libc-dev-bin (= 2.39-0ubuntu8.9),
+ libc6 (= 2.39-0ubuntu8.9),
+ libc6-dev (= 2.39-0ubuntu8.9),
  libcap-ng0 (= 0.8.4-2build2),
  libcap2 (= 1:2.66-5ubuntu2.4),
  libcc1-0 (= 14.2.0-4ubuntu2~24.04.1),
@@ -161,7 +161,7 @@ Installed-Build-Depends:
  libpam-runtime (= 1.5.3-5ubuntu5.7),
  libpam0g (= 1.5.3-5ubuntu5.7),
  libpcre2-8-0 (= 10.42-4ubuntu2.1),
- libperl5.38t64 (= 5.38.2-3.2ubuntu0.4),
+ libperl5.38t64 (= 5.38.2-3.2ubuntu0.6),
  libpipeline1 (= 1.5.7-2),
  libquadmath0 (= 14.2.0-4ubuntu2~24.04.1),
  libreadline8t64 (= 8.2-4build1),
@@ -170,7 +170,7 @@ Installed-Build-Depends:
  libsframe1 (= 2.42-4ubuntu2.10),
  libsigsegv2 (= 2.14-1ubuntu2),
  libsmartcols1 (= 2.39.3-9ubuntu6.6),
- libssl3t64 (= 3.0.13-0ubuntu3.15),
+ libssl3t64 (= 3.0.13-0ubuntu3.16),
  libstdc++-13-dev (= 13.3.0-6ubuntu2~24.04.1),
  libstdc++6 (= 14.2.0-4ubuntu2~24.04.1),
  libsub-override-perl (= 0.10-1),
@@ -183,9 +183,9 @@ Installed-Build-Depends:
  libudev1 (= 255.4-1ubuntu8.17),
  libunistring5 (= 1.1-2build1.1),
  libuuid1 (= 2.39.3-9ubuntu6.6),
- libxml2 (= 2.9.14+dfsg-1.3ubuntu3.8),
+ libxml2 (= 2.9.14+dfsg-1.3ubuntu3.9),
  libzstd1 (= 1.5.5+dfsg2-2build1.1),
- linux-libc-dev (= 6.8.0-139.139),
+ linux-libc-dev (= 6.8.0-146.146),
  llvm-16-linker-tools (= 1:16.0.6-23ubuntu4),
  llvm-17-linker-tools (= 1:17.0.6-9ubuntu1),
  llvm-18-linker-tools (= 1:18.1.3-1ubuntu1),
@@ -198,9 +198,9 @@ Installed-Build-Depends:
  ncurses-base (= 6.4+20240113-1ubuntu2.2),
  ncurses-bin (= 6.4+20240113-1ubuntu2.2),
  patch (= 2.7.6-7build3),
- perl (= 5.38.2-3.2ubuntu0.4),
- perl-base (= 5.38.2-3.2ubuntu0.4),
- perl-modules-5.38 (= 5.38.2-3.2ubuntu0.4),
+ perl (= 5.38.2-3.2ubuntu0.6),
+ perl-base (= 5.38.2-3.2ubuntu0.6),
+ perl-modules-5.38 (= 5.38.2-3.2ubuntu0.6),
  po-debconf (= 1.0.21+nmu1),
  readline-common (= 8.2-4build1),
  rpcsvc-proto (= 1.4.2-0ubuntu7),
@@ -216,4 +216,4 @@ Environment:
  DEB_BUILD_PROFILES="noudeb"
  LANG="C.UTF-8"
  MAKEFLAGS=""
- SOURCE_DATE_EPOCH="1789499954"
+ SOURCE_DATE_EPOCH="1791707400"
diff --git a/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13_amd64.changes b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13_amd64.changes
new file mode 100644
index 000000000..e068142c1
--- /dev/null
+++ b/packages/linuxmuster-webui7/lmn74/linuxmuster-webui7_7.4.13_amd64.changes
@@ -0,0 +1,55 @@
+Format: 1.8
+Date: Sun, 11 Oct 2026 10:30:00 +0200
+Source: linuxmuster-webui7
+Binary: linuxmuster-webui7
+Built-For-Profiles: noudeb
+Architecture: source all
+Version: 7.4.13
+Distribution: lmn74
+Urgency: medium
+Maintainer: Arnaud Kientz <arnaud@linuxmuster.net>
+Changed-By: Arnaud Kientz <arnaud@linuxmuster.net>
+Description:
+ linuxmuster-webui7 - Next generation web-based management tool for linuxmuster.net v7.
+Changes:
+ linuxmuster-webui7 (7.4.13) lmn74; urgency=medium
+ .
+   * [security] [lmn_linbo4] Avoid path traversal in the config/ and vdi/
+     routes.
+   * [lmn_linbo4] LINBO group names are validated: the list only shows
+     the start.conf whose group name is valid, and a duplicated group
+     can not be given a name sophomorix-device would refuse (. and +).
+   * [lmn_common] The credentials sent to linuxmuster-api are encoded as
+     UTF-8: requests encoded them as Latin-1, which can not carry a
+     password like €uro123. Needs linuxmuster-api 7.4.14 (#47).
+   * [lmn_common] A linuxmuster-api request that times out says so, and
+     that the operation may have been applied anyway, instead of asking
+     to log in again. Connecting times out after 3 s, answering after
+     10 s, 30 s for the password changes; reading the quotas has no
+     time limit any more.
+   * [lmn_common] The log viewer reads its offset in characters, as the
+     frontend sends it: a log holding non-ASCII characters ended with
+     "Server error occured". Fix #294, reported by @derdennis1012.
+   * [lmn_settings] [lmn_users] A refused request answers 403 instead of
+     failing with a 500.
+   * [lmn_auth] [lmn_users] [lmn_session_new] Password errors stay
+     displayed until closed, so a long password policy message can be
+     read.
+   * Schoolclasses and session members are sorted in natural order by
+     linuxmuster-tools (5a, 10b, then abitur).
+   * [packaging] Depends on linuxmuster-tools7 (>= 7.4.19).
+Checksums-Sha1:
+ 1fef5f382198f8e1ca1e01c56172fc7ce74b3a98 565 linuxmuster-webui7_7.4.13.dsc
+ 1b0b9f9c960f3fa4c6f59768423405bcfebc45e2 1631690 linuxmuster-webui7_7.4.13.tar.gz
+ 8ef87fe722b3cf1438fa7c34a78af6e39aebf958 840470 linuxmuster-webui7_7.4.13_all.deb
+ 20dec517c82406604e9a7075dac3f679bfe5f763 7803 linuxmuster-webui7_7.4.13_amd64.buildinfo
+Checksums-Sha256:
+ 4a6eeb41234f9520a38e758da25a177f217b24ccff3d5c9e12833226ad558487 565 linuxmuster-webui7_7.4.13.dsc
+ 90fea307675b6a772c168977f0b6c5bad0ad591157d161ae7179165ea898c54e 1631690 linuxmuster-webui7_7.4.13.tar.gz
+ 942cbf4872054f3aa1e1bc2c26e9ba51cccb92ddb2f6fb5fd09508ad32f3a24f 840470 linuxmuster-webui7_7.4.13_all.deb
+ e39054cdaa9b9a866e0e1d856486011610a04e69d754ca47017d35debc223e0a 7803 linuxmuster-webui7_7.4.13_amd64.buildinfo
+Files:
+ 5a148f2dd5d19c26216973c440c14ed6 565 admin optional linuxmuster-webui7_7.4.13.dsc
+ c3a79fe555bf0671eabd836404e4abdd 1631690 admin optional linuxmuster-webui7_7.4.13.tar.gz
+ d2fc3b76b959cefdeba970caf6b59325 840470 admin optional linuxmuster-webui7_7.4.13_all.deb
+ 02e4ae1eaafe42c3a8c73c29ca82e500 7803 admin optional linuxmuster-webui7_7.4.13_amd64.buildinfo