From 626275b187009fa4b70be36f17533b97bb986db4 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 26 Oct 2026 23:51:45 +0100 Subject: [PATCH] =?UTF-8?q?R-1303=20built=20and=20live-proven=20(test=20ma?= =?UTF-8?q?il=20arrived,=20seed=20run=20committed=20its=20memory);=20R-130?= =?UTF-8?q?5=E2=80=93R-1309=20filed=20(file=20manager,=2027=20apps,=20imag?= =?UTF-8?q?e=20packages,=20floating=20tags,=20mail-only=20notices);=20docs?= =?UTF-8?q?=2008=20=C2=A711,=20B23,=20monthly=20=C2=A74a;=20STATUS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- REPORT-security-watch-2026-10-26.md | 86 + STATUS.md | 22 +- documentation/architecture/08-alarm-ladder.md | 17 + .../architecture/capability-map-detail/B.md | 4 + .../ADVISORIES-2026-10-26.md | 39 + .../security-watch-2026-10-26/ci-dry.log | 764 +++++++++ .../security-watch-2026-10-26/ci-seed.log | 1478 +++++++++++++++++ .../security-watch-2026-10-26/ci-testmail.log | 52 + documentation/backlog/OPEN-ITEMS.md | 11 +- .../runbooks/monthly-floating-retest.md | 6 + 10 files changed, 2465 insertions(+), 14 deletions(-) create mode 100644 REPORT-security-watch-2026-10-26.md create mode 100644 documentation/audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md create mode 100644 documentation/audits/security-watch-2026-10-26/ci-dry.log create mode 100644 documentation/audits/security-watch-2026-10-26/ci-seed.log create mode 100644 documentation/audits/security-watch-2026-10-26/ci-testmail.log diff --git a/REPORT-security-watch-2026-10-26.md b/REPORT-security-watch-2026-10-26.md new file mode 100644 index 00000000..eba21de0 --- /dev/null +++ b/REPORT-security-watch-2026-10-26.md @@ -0,0 +1,86 @@ +# REPORT — the nightly security watch (R-1303), 2026-10-26 night + +> A sibling of `REPORT.md`: the night session owns `REPORT.md` tonight. Readings taken alone (the brief's „safest +> reading", stated first): +> 1. **The key:** the operator said yes; the token did not exist by the end, so the watch runs in no-key mode (box +> programs nightly, apps' advisory lists every second night) and switches by itself when `GH_ADVISORY_TOKEN` exists. +> The name is `GH_…`, not `GITHUB_…`: Gitea reserves the `GITHUB_` and `GITEA_` prefixes for Actions secrets. +> 2. **The memory:** a file the CI job commits to `main` itself (`documentation/security-watch/state.json`), not the +> runner's disk (two runners, two disks), not the Actions cache (needs a node step), not DooPlex (a host change). +> 3. **A seed that could not read everything** (no key) leaves those pins pending; their first real read is recorded +> silently. Otherwise the first nights after the seed would have been the mail storm the brief forbids. + +## In plain words + +1. **Sources picked:** GitHub's per-repo security advisories (the main source), GitHub release notes, the Cloudflare + blog plus cloudflared's own `VULN-` notes, OSV for our Go builders, and the registries for „newer version". **They + cannot see:** a fix told only by mail, forum or a blog we do not read; a security fix nobody calls one; packages inside + our own images (Debian, Alpine, Samba); closed-source apps (Plex, Emby); floating tags like `redis:7-alpine`. +2. **Watched:** 108 pins — 11 box programs and build bases, 97 catalog images (21 of them with a stated „no source"). +3. **First real run (the seed, CI job 2408):** ADVISORY on **30 pins (142 notices)**: 3 box programs (traefik, the file + manager, cloudflared) and 27 apps; BEHIND on 17; 0 NOT CHECKED. Nothing was mailed — the seed records them. +4. **The test mail arrived:** yes — „[Felhom security] TEST — not a real advisory …" in the admin@felhom.eu mailbox + (Resend id `01a17a5d-…`, CI job 2407). +5. **The operator does:** make the GitHub key and store it as `GH_ADVISORY_TOKEN` (CC's store and Gitea Actions). Then + decide the order of triage for the advisory list (R-1305, R-1306). + +## The ADVISORY list today (box programs first; full list `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`) + +| Program | Our version | Fixed in (notices) | +|---|---|---| +| traefik | v3.7.13 | v3.7.14–v3.7.16 (15; triage: none seems to apply to our config — R-1304) | +| file manager (FileBrowser Quantum) | 1.5.6-stable | 1.5.7-stable for 2 of 36 (GHSA-qx86, needs the password; GHSA-3846); the rest on 2.x (R-1305) | +| cloudflared | 2026.10.3 | 2026.10.4 (VULN-176088, metrics allowlist; our metrics are on the container's own loopback) + the eMudhra blog post (already fixed, R-1300) | +| 27 apps | — | e.g. Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.2.4; Seerr 2.7.3 → 3.5.0; Wanderer v0.20.0 → v0.21.2; Rallly 4.15.3 → 4.15.4; Immich v3.2.4 → v3.3.5 (notes); SparkyFitness: no fix yet (R-1306) | + +## Commits and CI (by commit) + +| Repo | Commit | What | CI | +|---|---|---|---| +| felhom.eu | `97ae7086` | spike + rows R-1303, R-1304 | job 2401 success | +| felhom.eu | `1f62d629` | the watch, the shared list + gate, tests, workflow | job 2402 success | +| felhom.eu | `6ee23a3b` | abandoned = GAP; seed-pending | (see below) | +| app catalog | `f61800a` | `upstream:` in 65 templates, gate + decoys, checklist 1.10 | job 2403 success | +| controller | `e01eb64b` | `upstream.txt`, `# upstream:` comments, gate + decoys | job 2404 success | +| felhom.eu | `ed843da7` | the memory, committed by the CI job itself | — | +| felhom.eu | (this commit) | docs, rows R-1305–R-1309, STATUS, this report | read at the end | + +Live runs in CI: job 2405 (dry: every host reached; 30 NOT CHECKED because DooPlex's shared GitHub quota was at 0 — +printed and counted, the reason for the key), 2407 (test mail), 2408 (seed; memory pushed). Tests: 38 checks, no +network; red-proved five ways (dedupe, streak, the 30-day window, a swallowed source error, the seed-pending set); the +two gates' decoys red-proved with a reader that reads comments. + +## Rows + +Before **215**, after **222**; opened **7** (R-1303 – R-1309), closed **0**. + +## Observations + +- traefik v3.7.13 inside 12 October advisories — **FILED: R-1304**. +- The file manager 1.5.6-stable inside 36 notices, 2 fixed in its own channel — **FILED: R-1305**. +- 27 app pins with published notices — **FILED: R-1306** (one row; the list is the file). +- Packages inside our own images not watched — **FILED: R-1307**. Floating tags — **FILED: R-1308**. Mail-only and + silent fixes, closed-source apps — **FILED: R-1309**. +- Three upstream repos renamed (cal.com → `calcom/cal.diy`, jellyseerr → `seerr-team/seerr`, wanderer → + `open-wanderer/wanderer`) — **NOT-A-FINDING: the mapping uses the new names; the images still pull.** +- plant-it's image name points nowhere — **NOT-A-FINDING: known and stated in its template (abandoned); the watch lists + it as GAP and never looks it up.** +- The hub's Dockerfile lines are not gated in felhom.eu's own runner (only the catalog's and the controller's are) — + **NOT-A-FINDING: the watch reads them nightly and reports a missing line as NOT CHECKED; a gate there would need its + own decoy suite for two lines.** +- nginx's channel test treats 1.31 (mainline) as the same channel as 1.30 (stable) — **NOT-A-FINDING: BEHIND is a weekly + hint; the notice match does not depend on it.** +- Without a key, the dry run spent DooPlex's whole GitHub quota (shared with every DooPlex client) — **NOT-A-FINDING: + that is R-1303's „blocked on"; the watch reported it as NOT CHECKED, as designed.** + +## Documents changed + +`runbooks/monthly-floating-retest.md` §4a (the BEHIND check is nightly; the monthly run keeps the same-name re-test); +`architecture/capability-map-detail/B.md` B23 (a watch mail starts the lane); `architecture/08-alarm-ladder.md` §11 (the +three signals, `[DESIGN]`); `scripts/CHANGELOG.md`; `REUSE.md`; the catalog's `NEW-APP-CHECKLIST.md` 1.10. System +poster: none of the three needed — no machine, path, backup tier or key changed (a CI job reads public sources). + +## Teardown + +Machine and host: nothing provisioned. Hub: nothing. CI: three manual runs, no lasting change but the memory file. Work +copies `felhom.eu-cfsec`, `app-catalog-cfsec`, `felhom-controller-cfsec` on DooPlex: removed at the end, all pushed. diff --git a/STATUS.md b/STATUS.md index 2604a826..58740343 100644 --- a/STATUS.md +++ b/STATUS.md @@ -23,7 +23,7 @@ - DooPlex: something sets the shared checkout to „bare" (R-935). ## What we work on -- Released: 0.345.1 (cloudflared 2026.10.3, security), every box. Built, not released (Tuesday's block, each on your yes): R-1291, R-1220, R-1232, R-1187, R-1219, R-1298, R-972, R-1285. R-1218 needs you: off-site off on Tester 1 for minutes (hub customer page), or it leaves the release. +- Built, not released (Tuesday's block, each on your yes): R-1291, R-1220, R-1232, R-1187, R-1219, R-1298, R-972, R-1285. R-1218 needs you: off-site off on Tester 1 for minutes (hub customer page), or it leaves the release. - Dated checks, run by CC. 2026-10-27: the line test on a seeding box, DooPlex's qBittorrent as the peer (R-1250, your yes). 2026-10-30: D35, website and installer to Cloudflare, starts (R-1228, ruled yes). ## Waiting on you — decide @@ -40,22 +40,22 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te ## Waiting on you — do **Still needed? (yes/no)** — CC could not check these. Answer yes or no per line. -1. Look at `roms/roms/` on the N100's drive in the file manager (R-1099). Since 2026-10-16. -2. The N100 sheet, about 30 minutes: Plex, the admins in Prowlarr, Sonarr and Radarr, your download sources (`documentation/audits/n100-lived-in-2026-10-15/SHEET.md`). Since 2026-10-15. -3. Look at these demo-hp pages when you have time: Calibre-Web, the file manager, AdventureLog, Plex, the app page, the Plex and Sonarr guides. Since 2026-10-16. -4. Remove the test server „plex-k6" from your Plex account (plex.tv → Settings → Authorized Devices). Since 2026-10-15. -5. Ask Google to index `https://felhom.eu/sajat-felho-tarhely` in Search Console (R-1035). Since 2026-10-14. -6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. Since 2026-10-14. -7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). Since 2026-10-12. +1. Look at `roms/roms/` on the N100's drive in the file manager (R-1099). (since 10-16) +2. The N100 sheet, about 30 minutes: Plex, the admins in Prowlarr, Sonarr and Radarr, your download sources (`documentation/audits/n100-lived-in-2026-10-15/SHEET.md`). (since 10-15) +3. Look at these demo-hp pages when you have time: Calibre-Web, the file manager, AdventureLog, Plex, the app page, the Plex and Sonarr guides. (since 10-16) +4. Remove the test server „plex-k6" from your Plex account (plex.tv → Settings → Authorized Devices). (since 10-15) +5. Ask Google to index `https://felhom.eu/sajat-felho-tarhely` in Search Console (R-1035). (since 10-14) +6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. (since 10-14) +7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). (since 10-12) -**2026-10-26.** On the hub's Hosts page, delete `Tester4-b5dbbd` (CC's test VM of tonight, uninstalled and destroyed; you already deleted `Tester4-b5ec39`). If not: the hub alarms that the box went silent. After demo-hp's window has run (CC says when, Tuesday morning), revoke the token `cc-d55-window` (R-1294). +**2026-10-26.** On the hub's Hosts page, delete `Tester4-b5dbbd` (CC's test VM of tonight, uninstalled and destroyed; you already deleted `Tester4-b5ec39`). If not: the hub alarms that the box went silent. After demo-hp's window has run (CC says when, Tuesday morning), revoke the token `cc-d55-window` (R-1294). New: a nightly security watch mails you (R-1303); make it a GitHub key, no repo access, as `GH_ADVISORY_TOKEN`. **2026-10-23 do list.** 1. Print the break-glass sheet (`documentation/runbooks/break-glass-sheet.md`, the part from „The sheet”, one A4), fill it by hand, keep it outside the home (D32; R-923, R-924). If not: after a DooPlex loss no off-site copy opens. 2. On the hub's Hosts page: Discard appliance 49. If not: a dead entry alarms. 3. Give the homelab session R-1241, R-1242, the lists at the end of `documentation/audits/plex2shell-felhom-impact-2026-10-23/README.md` and `documentation/audits/dooplex-alarms-2026-10-24/README.md`, and an upload alarm on DooPlex's `eno1` (~100 Mbit/s line; the flood peaked at 905). If not: the next hacked app on DooPlex can read the hub's backups. **The rest** - System poster needs a refresh: the new 01:40 „release copy” arrow from DooPlex to ep0 (D33); the hub-database label already says every 6 hours. If not: the drawing misses one copy. -- Rotate the reused homelab logins and decide the Gitea repo's visibility (R-925, P1). Since 2026-10-09. -- Two DooPlex leftovers: `leftovers/2026-10-14/first-post/` (keep or delete); the `deny`-list edit in homelab-manifests' `.claude/settings.json` (commit or drop). Since 2026-10-14. +- Rotate the reused homelab logins and decide the Gitea repo's visibility (R-925, P1). (since 10-09) +- Two DooPlex leftovers: `leftovers/2026-10-14/first-post/` (keep or delete); the `deny`-list edit in homelab-manifests' `.claude/settings.json` (commit or drop). (since 10-14) - Before the first paying customer: Tandoor's permission (R-789); a lawyer for the licence list and the terms (R-802, R-813); SparkyFitness by e-mail (R-784). - Later (yours, not urgent): R-1250 (a seeding qBittorrent is never tested), R-1248 (a hard upload cap per app), R-1229 (ArgoCD's sync settings into git), R-862 (Tester 2's bootstrap, when it is back), R-504, R-1071, R-1073, R-1077, R-1042, R-132, R-908, R-779, R-904, R-232, R-433, R-933, R-213, R-832, R-388, R-882, R-883, R-814, R-1056, R-1164, R-930, R-920, R-902. diff --git a/documentation/architecture/08-alarm-ladder.md b/documentation/architecture/08-alarm-ladder.md index 7ff72eee..42371747 100644 --- a/documentation/architecture/08-alarm-ladder.md +++ b/documentation/architecture/08-alarm-ladder.md @@ -662,3 +662,20 @@ every grace — a test configuration only. Live proof: `audits/d53-held-apps-202 every household leg `skipped operator_only`). *[DESIGN] R-1298 (2026-10-26 night, controller main `b156e45`): an install's hold (`unhealthy_stop`, `update_failed`, `putback_pending`) of an app that is NOT installed (no `app.yaml`) is not reported — it would remind weekly about an app that does not exist; a restore hold is always reported (R-379, a person clears it).* + +## 11. The security watch — three operator-only signals [DESIGN — built 2026-10-26: felhom.eu `1f62d629`, `6ee23a3b`; R-1303] + +The nightly CI job `security-watch` (03:40 UTC, `scripts/security_watch.py`) reads where each shipped program publishes +its security notices (sources and their limits: `audits/security-watch-2026-10-26/SPIKE.md`) and mails **admin@felhom.eu +only** — no household, no hub event: + +| Signal | When | Once? | +|---|---|---| +| **ADVISORY** — „[Felhom security] — N new advisories" | a notice affects the version we pin | once per (program, notice); a reminder every 7 days while it stays open; a vendor-blog notice never repeats | +| **BEHIND** — „[Felhom security] weekly: …" | Monday (or the last summary is 8+ days old) | one summary; it also lists GAP, FLOATING and tonight's NOT CHECKED | +| **NOT CHECKED** — „[Felhom security] the watch could not check …" | the same source failed two nights in a row | once per streak; a good night resets it | + +The memory is `documentation/security-watch/state.json`, committed by the job itself; a missing memory re-seeds AND mails +that it did. A job that does not finish mails „[felhom CI] security watch FAILED". The mail starts the security-fix lane +(capability map B23). + diff --git a/documentation/architecture/capability-map-detail/B.md b/documentation/architecture/capability-map-detail/B.md index a7687d7d..2d840d6d 100644 --- a/documentation/architecture/capability-map-detail/B.md +++ b/documentation/architecture/capability-map-detail/B.md @@ -392,6 +392,10 @@ four version observables at TO, a 600 s memory soak), and the only writer turns ladder step. Every box on controller >= 0.341.0 takes it at night with the usual guards (backup first, undo on a failed health check, held / stopped / needs_person / W+5h respected). +**Trigger (2026-10-26, R-1303):** a mail from the nightly security watch („[Felhom security] …", `08` §11) starts the +lane: it names the program, our version and the fixed version. An app notice goes this lane; a box program's (traefik, +cloudflared, the file manager) is a controller release — the cloudflared 2026.10.3 run (R-1300) is the worked example. + **Components:** catalog `3898593` (`ladder.py check_security`, the two test-record gates, `upgrade-test.py --write-ladder --security`, `box_walk.py --security`); controller v0.341.0 (`legCandidate`). diff --git a/documentation/audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md b/documentation/audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md new file mode 100644 index 00000000..9a92664b --- /dev/null +++ b/documentation/audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md @@ -0,0 +1,39 @@ +# Open advisories at the first run — 2026-10-26 (security watch seed, CI job 2408) + +One row per pin. „Fixed in" lists every fixed version the notices name. A seed mails nothing; this is the list it +would have mailed. Box programs first. Full text: `ci-seed.log` (WOULD HAVE MAILED). + +| Program (owner) | Our version | Notices | Fixed in | Worst severity | Sources | +|---|---|---|---|---|---| +| cloudflare/cloudflared (controller infra) | 2026.10.3 | 2 | 2026.10.4; read the notice | not given | release notes (cloudflared), vendor notice (cloudflare-blog) | +| gtstef/filebrowser (controller infra) | 1.5.6-stable | 36 | 1.5.7-stable, 2.0.10-beta; 1.5.7-stable, 2.0.8-beta; 2.0.0-stable; 2.0.0-stable, 2.0.10-beta; 2.0.1-stable; 2.0.1-stable | high | GitHub advisory, release notes | +| traefik (controller infra) | v3.7.13 | 15 | v3.7.14; v3.7.15; v3.7.16 | high | GitHub advisory, release notes | +| codewithcj/sparkyfitness (sparkyfitness) | v0.17.3 | 3 | no fixed version named yet | medium | GitHub advisory | +| codewithcj/sparkyfitness_server (sparkyfitness) | v0.17.3 | 3 | no fixed version named yet | medium | GitHub advisory | +| docmost/docmost (docmost) | 0.96.0 | 1 | v0.97.0 | not given | release notes | +| f0rc3/gokapi (gokapi) | v1.9.6 | 10 | 2.2.3; 2.2.4; v2.0.0 | high | GitHub advisory | +| fallenbagel/jellyseerr (seerr) | 2.7.3 | 6 | 3.1.0; 3.4.0; 3.5.0 | high | GitHub advisory | +| flomp/wanderer-db (wanderer) | v0.20.0 | 11 | v0.21.0; v0.21.2 | critical | GitHub advisory, release notes | +| flomp/wanderer-web (wanderer) | v0.20.0 | 11 | v0.21.0; v0.21.2 | critical | GitHub advisory, release notes | +| freikin/dawarich (dawarich) | 1.15.3 | 1 | 1.17.0 | not given | release notes | +| ghcr.io/advplyr/audiobookshelf (audiobookshelf) | 2.37.1 | 1 | v2.37.2 | not given | release notes | +| ghcr.io/alam00000/bentopdf (bentopdf) | v2.8.6 | 5 | no fixed version named yet; v2.8.10; v2.8.7 | medium | GitHub advisory, release notes | +| ghcr.io/cmintey/wishlist (wishlist) | v0.67.1 | 2 | v0.68.0; v0.69.0 | not given | release notes | +| ghcr.io/home-assistant/home-assistant (home-assistant) | 2026.9.4 | 1 | the range is unreadable — check by hand | low | GitHub advisory | +| ghcr.io/immich-app/immich-machine-learning (immich) | v3.2.4 | 2 | the range is unreadable — check by hand; v3.3.5 | critical | GitHub advisory, release notes | +| ghcr.io/immich-app/immich-server (immich) | v3.2.4 | 2 | the range is unreadable — check by hand; v3.3.5 | critical | GitHub advisory, release notes | +| ghcr.io/karakeep-app/karakeep (karakeep) | 0.33.2 | 3 | no fixed version named yet; v0.34.0; v0.34.1 | high | GitHub advisory, release notes | +| ghcr.io/sysadminsmedia/homebox (homebox) | 0.26.2 | 2 | v0.27.0; v0.27.1 | not given | release notes | +| ghcr.io/tandoorrecipes/recipes (tandoor) | 2.6.15 | 1 | 2.7.0 | not given | release notes | +| grafana/grafana (grafana) | 13.2.3 | 1 | v13.2.4 | not given | release notes | +| jellyfin/jellyfin (jellyfin) | 10.11.11 | 6 | 12.0 | critical | GitHub advisory | +| louislam/uptime-kuma (uptime-kuma) | 2.5.5 | 4 | 2.5.6; 2.5.7; 2.5.8; the range is unreadable — check by hand | medium | GitHub advisory, release notes | +| lscr.io/linuxserver/bookstack (bookstack) | 26.09.1 | 1 | v26.09.2 | not given | release notes | +| lscr.io/linuxserver/code-server (code-server) | 4.129.0 | 1 | v4.141.1 | not given | release notes | +| lukevella/rallly (rallly) | 4.15.3 | 5 | 4.15.4; v4.15.4; v4.15.5; v4.16.0; v4.16.2 | critical | GitHub advisory, release notes | +| outlinewiki/outline (outline) | 1.10.1 | 1 | v1.12.0 | not given | release notes | +| privatebin/pdo (privatebin) | 2.0.6 | 1 | 2.1.0 | not given | release notes | +| rommapp/romm (romm) | 5.3.1 | 2 | 5.4.0; 5.4.1 | not given | release notes | +| vikunja/vikunja (vikunja) | 2.6.0 | 2 | v2.7.0; v2.7.1 | not given | release notes | + +142 notices on 30 pins. diff --git a/documentation/audits/security-watch-2026-10-26/ci-dry.log b/documentation/audits/security-watch-2026-10-26/ci-dry.log new file mode 100644 index 00000000..6304c073 --- /dev/null +++ b/documentation/audits/security-watch-2026-10-26/ci-dry.log @@ -0,0 +1,764 @@ +felhom-gates-runner-2(version:v0.6.1) received task 2427 of job watch, be triggered by event: workflow_dispatch +workflow prepared +evaluating expression 'success()' +expression 'success()' evaluated to 'true' +evaluating expression '' +expression '' evaluated to 'true' +⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos +Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh' +::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +base=http://gitea.gitea-system.svc.cluster.local:3000/admin +git init -q . && git remote add origin $base/felhom.eu.git +git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD +echo "felhom.eu main at $(git rev-parse --short=12 HEAD)" +for r in felhom-controller app-catalog-felhom.eu; do + git init -q ../$r && git -C ../$r remote add origin $base/$r.git + git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD + echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)" +done +shell: bash --noprofile --norc -e -o pipefail {0} +::endgroup:: +felhom.eu main at 1f62d629158c +felhom-controller at e01eb64b2591 +app-catalog-felhom.eu at f61800aae945 +::group::Run set -u +set -u +mkdir -p documentation/security-watch +mode="${MODE:-run}" +[ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run +echo "mode: $mode" +case "$mode" in + test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;; + dry) extra="--no-mail" ; state=/tmp/state-dry.json + cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;; + seed) extra="--seed" ; state=documentation/security-watch/state.json ;; + run) extra="" ; state=documentation/security-watch/state.json ;; + *) echo "unknown mode $mode"; exit 2 ;; +esac +python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \ + --controller=../felhom-controller --json=/tmp/watch-results.json $extra +shell: bash --noprofile --norc -e -o pipefail {0} +env: + RESEND_API_KEY: *** + GH_ADVISORY_TOKEN: + MODE: dry +::endgroup:: +mode: dry +/root/.cache/act/6ed0fc4eeecacefe/hostexecutor/scripts/security_watch.py:687: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC). + today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date() +security watch 2026-10-26: 108 pins (11 box/build, 97 app); GitHub key ABSENT — apps' advisories in a 2-night rotation +ADVISORY box cloudflare/cloudflared 2026.10.3 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.4:VULN-176088 (fixed 2026.10.4) +ADVISORY box gtstef/filebrowser 1.5.6-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more +ADVISORY box traefik v3.7.13 GHSA-hrpp-p4fc-wwf8 (fixed v3.7.16); GHSA-p8wx-ph99-xgcr (fixed v3.7.15); GHSA-fh26-gfpp-7xxx (fixed v3.7.14); GHSA-qvj7-gq9c-hp7q (fixed v3.7.14); … 11 more +ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0) +ADVISORY app ghcr.io/sysadminsmedia/homebox 0.26.2 release:sysadminsmedia/homebox@v0.27.1 (fixed v0.27.1); release:sysadminsmedia/homebox@v0.27.0 (fixed v0.27.0) +ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 release:TandoorRecipes/recipes@2.7.0 (fixed 2.7.0) +ADVISORY app grafana/grafana 13.2.3 release:grafana/grafana@v13.2.4 (fixed v13.2.4) +ADVISORY app lscr.io/linuxserver/bookstack 26.09.1 release:BookStackApp/BookStack@v26.09.2 (fixed v26.09.2) +ADVISORY app lscr.io/linuxserver/code-server 4.129.0 release:coder/code-server@v4.141.1 (fixed v4.141.1) +ADVISORY app outlinewiki/outline 1.10.1 release:outline/outline@v1.12.0 (fixed v1.12.0) +ADVISORY app privatebin/pdo 2.0.6 release:PrivateBin/PrivateBin@2.1.0 (fixed 2.1.0) +ADVISORY app rommapp/romm 5.3.1 release:rommapp/romm@5.4.1 (fixed 5.4.1); release:rommapp/romm@5.4.0 (fixed 5.4.0) +ADVISORY app vikunja/vikunja 2.6.0 release:go-vikunja/vikunja@v2.7.1 (fixed v2.7.1); release:go-vikunja/vikunja@v2.7.0 (fixed v2.7.0) +NOT CHECKED app codewithcj/sparkyfitness v0.17.3 GitHub API rate limit reached earlier tonight +NOT CHECKED app codewithcj/sparkyfitness_server v0.17.3 GitHub API rate limit reached earlier tonight +NOT CHECKED app crocodilestick/calibre-web-automated v4.0.8 GitHub API rate limit reached earlier tonight +NOT CHECKED app docmost/docmost 0.96.0 GitHub API rate limit reached earlier tonight +NOT CHECKED app f0rc3/gokapi v1.9.6 GitHub API rate limit reached earlier tonight +NOT CHECKED app fallenbagel/jellyseerr 2.7.3 GitHub API rate limit reached earlier tonight +NOT CHECKED app flomp/wanderer-db v0.20.0 GitHub API rate limit reached earlier tonight +NOT CHECKED app flomp/wanderer-web v0.20.0 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/advplyr/audiobookshelf 2.37.1 GitHub API rate limit (403) +NOT CHECKED app ghcr.io/alam00000/bentopdf v2.8.6 GitHub API rate limit (403) +NOT CHECKED app ghcr.io/cmintey/wishlist v0.67.1 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/gramps-project/grampsweb v25.6.0 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/grimmory-tools/grimmory v3.5.0 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/hargata/lubelogger v1.7.3 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/home-assistant/home-assistant 2026.9.4 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/immich-app/immich-machine-learning v3.2.4 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/immich-app/immich-server v3.2.4 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/karakeep-app/karakeep 0.33.2 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/kozea/radicale 3.8.1 GitHub API rate limit reached earlier tonight +NOT CHECKED app ghcr.io/seanmorley15/adventurelog-backend v0.13.0 GitHub API rate limit (403) +NOT CHECKED app jellyfin/jellyfin 10.11.11 GitHub API rate limit reached earlier tonight +NOT CHECKED app kimai/kimai2 2.67.0 GitHub API rate limit reached earlier tonight +NOT CHECKED app louislam/uptime-kuma 2.5.5 GitHub API rate limit reached earlier tonight +NOT CHECKED app lscr.io/linuxserver/grocy 4.7.1 GitHub API rate limit reached earlier tonight +NOT CHECKED app lscr.io/linuxserver/sonarr 4.0.20 GitHub API rate limit reached earlier tonight +NOT CHECKED app lukevella/rallly 4.15.3 GitHub API rate limit reached earlier tonight +NOT CHECKED app msdeluise/plant-it 0.10.0 GitHub API rate limit reached earlier tonight; Docker registry tags of msdeluise/plant-it: HTTP 401 +NOT CHECKED app nextcloud 34.0.4-apache GitHub API rate limit reached earlier tonight; GitHub API rate limit reached earlier tonight +NOT CHECKED app onlyoffice/documentserver 9.4.0 GitHub API rate limit reached earlier tonight +NOT CHECKED app qbittorrentofficial/qbittorrent-nox 5.2.4-1 GitHub API rate limit reached earlier tonight +BEHIND app actualbudget/actual-server 26.9.0 newest 26.10.0 +BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0 +BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0 +BEHIND app ghcr.io/alexta69/metube 2026.09.29 newest 2026.10.25 +BEHIND app ghcr.io/lukegus/termix 2.8.0 newest 2.9.2 +BEHIND app ghcr.io/mealie-recipes/mealie v3.28.0 newest v3.29.0 +BEHIND app ghcr.io/papra-hq/papra 26.6.2-rootless newest 26.7.1-rootless +BEHIND app ghost 6.67.0-alpine newest 6.72.0-alpine +BEHIND app glanceapp/glance v0.8.5 newest v0.8.7 +BEHIND app gotson/komga 1.28.0 newest 1.29.1 +BEHIND app n8nio/n8n 2.42.1 newest 2.45.4 +BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine +GAP buil alpine 3.24.2 newest 3.24.3 +GAP buil alpine 3.24.2 newest 3.24.3 +GAP buil debian 13.7-slim +GAP buil debian 13.7-slim +GAP app emby/embyserver 4.11.0.4 newest 4.11.0.10 +GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg +GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1 +GAP app mariadb 12.3 +GAP app mariadb 11.4 newest 11.8 +GAP app mariadb 11.8 +GAP app mariadb 12.3 +GAP app mariadb 11.8 +GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0 +GAP app postgis/postgis 16-3.5-alpine +GAP app postgis/postgis 17-3.5-alpine +GAP app postgres 18-alpine +GAP app postgres 17-alpine +GAP app postgres 18-alpine +GAP app postgres 18-alpine +GAP app postgres 18-alpine +GAP app postgres 18-alpine +GAP app postgres 18-alpine +GAP app postgres 17-alpine +GAP app postgres 16-alpine +GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0 +FLOATING app ghcr.io/claperco/claper 2.5 +FLOATING app ghcr.io/thomiceli/opengist 1.15 +FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623 +FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3 +FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0 +FLOATING app nzbgetcom/nzbget v26.3 +FLOATING app redis 7.4-alpine +FLOATING app redis 7-alpine +FLOATING app redis 7-alpine +FLOATING app redis 7-alpine +FLOATING app redis 7-alpine +FLOATING app redis 7-alpine +FLOATING app redis 7-alpine +FLOATING app wger/server 2.7 +SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0 +SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11 +CURRENT buil golang 1.27.3-trixie +CURRENT buil golang 1.27.3-alpine3.24 +CURRENT buil restic 0.19.1 +CURRENT app calcom/cal.com v6.2.0 +CURRENT app deluan/navidrome 0.64.2 +CURRENT app ghcr.io/diced/zipline 4.8.0 +CURRENT app ghcr.io/gethomepage/homepage v1.13.2 +CURRENT app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 +CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 +CURRENT app gitea/gitea 1.27.3 +CURRENT app lscr.io/linuxserver/radarr 6.4.4 +CURRENT app vaultwarden/server 1.37.4-alpine +COUNTS ADVISORY=13 BEHIND=12 CURRENT=12 FLOATING=14 GAP=25 NOT_CHECKED=30 SELF=2 +REQUESTS api.github.com=8 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=52 github.com=34 hub.docker.com=145 raw.githubusercontent.com=1 registry-1.docker.io=1 +WOULD HAVE MAILED (seed): [Felhom security] cloudflared, filebrowser, traefik, dawarich … — 66 new advisories +The nightly security watch (felhom.eu R-1303) found a notice that affects a version we ship. + +Box programs first. + +cloudflare/cloudflared — feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 + What: 8 eMudhra certificates are compromised. Here's what you need to know + Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage) + Fixed in: read the notice + Severity: not given + Source: vendor notice (cloudflare-blog) + Link: https://blog.cloudflare.com/emudhra-certificate-compromise/ + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +cloudflare/cloudflared — vulnnotes:cloudflared@2026.10.4:VULN-176088 + What: - 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server + Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage) + Fixed in: 2026.10.4 + Severity: not given + Source: release notes (cloudflared) + Link: https://raw.githubusercontent.com/cloudflare/cloudflared/master/RELEASE_NOTES + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-26fh-r34c-qxh6 + What: Moving or renaming a folder retargets public shares to the whole folder + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.2-stable, 2.1.3-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-26fh-r34c-qxh6 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-3846-gh75-gp3m + What: Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override) + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 1.5.7-stable, 2.0.8-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3846-gh75-gp3m + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-3j46-5w28-f8p2 + What: Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.1.0-stable, 2.1.3-beta + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3j46-5w28-f8p2 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-4fhx-8pf6-5gmr + What: Duplicate finder can show another user’s restricted file names from a shared cache + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.2-stable, 2.1.3-beta + Severity: low + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4fhx-8pf6-5gmr + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-4v62-884x-2466 + What: Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.1.0-stable, 2.1.3-beta + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4v62-884x-2466 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-4vrc-935w-xxq2 + What: Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonicalization + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.1.0-stable, 2.1.3-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4vrc-935w-xxq2 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-4wmj-rq3c-m65v + What: Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken` + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: >= 2.0.1-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4wmj-rq3c-m65v + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-55mw-cwg7-m8f5 + What: `GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.5-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-55mw-cwg7-m8f5 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-6gr6-5qpq-888p + What: Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.10-beta + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-6gr6-5qpq-888p + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-8655-2ph3-q7q7 + What: Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.2-stable, 2.1.3-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8655-2ph3-q7q7 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-8m35-wcjh-95q7 + What: Logout Bypass via Alternate JWT Spelling + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: >= 2.0.1-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8m35-wcjh-95q7 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-9fcr-gm58-p839 + What: Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.1.0-stable, 2.1.3-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9fcr-gm58-p839 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-9wm6-jcjh-3m8c + What: Stored XSS via Unsanitized DOCX Hyperlink in DocViewer + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: >=2.0.1-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9wm6-jcjh-3m8c + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-c7pj-xjp9-x4xp + What: Read-only users can overwrite files through PUT /api/resources + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.0-stable + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c7pj-xjp9-x4xp + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-c84q-q5g6-r47f + What: createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write) + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.1-stable, 2.1.2-beta + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c84q-q5g6-r47f + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-c9cr-w724-gqj3 + What: Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.1-stable + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c9cr-w724-gqj3 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-cw65-p35p-633w + What: FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory) + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: >= 2.0.0-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-cw65-p35p-633w + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-g2q5-r6ch-v25f + What: FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj) + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.1.0-stable, 2.1.3-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-g2q5-r6ch-v25f + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-gfgm-886h-6r47 + What: Custom API token with no global caps inherits owner admin access + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.2-stable, 2.1.4-beta + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-gfgm-886h-6r47 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-mgqf-5mf5-prfj + What: Symlink following escapes user scope allowing arbitrary file read outside the served directory + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: >= 2.0.1-beta + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-p7x3-p5jj-9xfh + What: Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.0-stable, 2.0.10-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p7x3-p5jj-9xfh + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-p93p-v944-4p44 + What: Unarchive writes into folders denied by access rules and overwrites files without modify permission + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.1.0-stable, 2.1.3-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p93p-v944-4p44 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-p9wm-f5jj-75pj + What: FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.2-stable, 2.1.3-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p9wm-f5jj-75pj + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-qqf3-2wvq-q4w9 + What: Archive download follows symlinks out of source scope (arbitrary file read) + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.1.0-stable, 2.1.3-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqf3-2wvq-q4w9 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-qv53-4557-m65h + What: Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: >= v2.0.0-beta + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qv53-4557-m65h + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-qx86-4v5r-26g5 + What: MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`) + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 1.5.7-stable, 2.0.10-beta + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qx86-4v5r-26g5 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-r744-4vm3-2px3 + What: Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and password changes + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.2-stable, 2.1.3-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r744-4vm3-2px3 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-rmjp-pfrq-cc3v + What: Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: 2.0.2-stable, 2.1.3-beta + Severity: high + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rmjp-pfrq-cc3v + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-rqqq-wv83-rp74 + What: Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope + Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) + Fixed in: >= v2.0.1-beta + Severity: medium + Source: GitHub advisory + Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rqqq-wv83-rp74 + Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release + +gtstef/filebrowser — GHSA-vvm6-jwrf-hgmg + What: Stored XSS via HTML Preview — `