diff --git a/ChangeLog b/ChangeLog
index 5fb1f7c..2900623 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,17 @@
+btrbk-0.32.7
+
+  * MIGRATION
+    - Update ssh_filter_btrbk.sh on remote hosts.
+    - All users using ssh_filter_btrbk.sh in their authorized_keys
+      configurations should upgrade immediately.
+  * This release fixes a critical security vulnerability
+    (CVE-2026-62943) in ssh_filter_btrbk.sh.
+    Specially crafted commands can bypass filter checks and execute
+    arbitrary commands. Applies to remote hosts using
+    ssh_filter_btrbk.sh in authorized_keys for command filtering.
+    Thanks to @machin0r for responsible disclosure.
+  * Minor bugfixes, spelling and documentation improvements.
+
 btrbk-0.32.6
 
   * Fix backup of unrelated (by parent_uuid) snapshots (close #339).
diff --git a/btrbk b/btrbk
index ddb2eb4..0c792d7 100755
--- a/btrbk
+++ b/btrbk
@@ -2,7 +2,7 @@
 #
 # btrbk - Create snapshots and remote backups of btrfs subvolumes
 #
-# Copyright (C) 2014-2023 Axel Burri
+# Copyright (C) 2014-2026 Axel Burri
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
diff --git a/doc/btrbk.1.asciidoc b/doc/btrbk.1.asciidoc
index a980b3b..cdaadce 100644
--- a/doc/btrbk.1.asciidoc
+++ b/doc/btrbk.1.asciidoc
@@ -1,7 +1,7 @@
 btrbk(1)
 ========
-:date: 2023-03-25
-:release-version: 0.32.6
+:date: 2026-07-19
+:release-version: 0.32.7
 :man manual: Btrbk Manual
 :man source: Btrbk {release-version}
 
diff --git a/doc/btrbk.conf.5.asciidoc b/doc/btrbk.conf.5.asciidoc
index 04f8e4d..a1e9466 100644
--- a/doc/btrbk.conf.5.asciidoc
+++ b/doc/btrbk.conf.5.asciidoc
@@ -1,7 +1,7 @@
 btrbk.conf(5)
 =============
-:date: 2023-03-25
-:release-version: 0.32.6
+:date: 2026-07-19
+:release-version: 0.32.7
 :man manual: Btrbk Manual
 :man source: Btrbk {release-version}
 
diff --git a/doc/lsbtr.1.asciidoc b/doc/lsbtr.1.asciidoc
index 1a96b96..cab1b94 100644
--- a/doc/lsbtr.1.asciidoc
+++ b/doc/lsbtr.1.asciidoc
@@ -1,7 +1,7 @@
 lsbtr(1)
 ========
-:date: 2023-03-25
-:release-version: 0.32.6
+:date: 2026-07-19
+:release-version: 0.32.7
 :man manual: Btrbk Manual
 :man source: Btrbk {release-version}
 
diff --git a/doc/ssh_filter_btrbk.1.asciidoc b/doc/ssh_filter_btrbk.1.asciidoc
index cc3883b..dc6ebac 100644
--- a/doc/ssh_filter_btrbk.1.asciidoc
+++ b/doc/ssh_filter_btrbk.1.asciidoc
@@ -1,7 +1,7 @@
 ssh_filter_btrbk(1)
 ===================
-:date: 2023-03-25
-:release-version: 0.32.6
+:date: 2026-07-19
+:release-version: 0.32.7
 :man manual: Btrbk Manual
 :man source: Btrbk {release-version}
 
diff --git a/ssh_filter_btrbk.sh b/ssh_filter_btrbk.sh
index 0817563..d8adcb0 100755
--- a/ssh_filter_btrbk.sh
+++ b/ssh_filter_btrbk.sh
@@ -96,12 +96,12 @@ reject_filtered_cmd()
     # allow multiple paths (e.g. "btrfs subvolume snapshot <src> <dst>")
     allow_cmd_match="(${allow_list})( ${option_match})*( ${path_match})+"
     stream_in_match="(${decompress_match} \| )?(${mbuffer_match} \| )?"
-    stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match}$)?"
+    stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match})?"
 
     # `grep`’s `-q`-option is not used as it may cause an exit status of `0` even
     # when an error occurred.
 
-    allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}"
+    allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}$"
     if printf '%s' "${SSH_ORIGINAL_COMMAND}" | grep -E "${allow_stream_match}" >/dev/null 2>/dev/null; then
         return 0
     fi