felhom-gates-runner-2(version:v0.6.1) received task 2427 of job watch, be triggered by event: workflow_dispatch workflow prepared evaluating expression 'success()' expression 'success()' evaluated to 'true' evaluating expression '' expression '' evaluated to 'true' ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh' ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" base=http://gitea.gitea-system.svc.cluster.local:3000/admin git init -q . && git remote add origin $base/felhom.eu.git git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD echo "felhom.eu main at $(git rev-parse --short=12 HEAD)" for r in felhom-controller app-catalog-felhom.eu; do git init -q ../$r && git -C ../$r remote add origin $base/$r.git git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)" done shell: bash --noprofile --norc -e -o pipefail {0} ::endgroup:: felhom.eu main at 1f62d629158c felhom-controller at e01eb64b2591 app-catalog-felhom.eu at f61800aae945 ::group::Run set -u set -u mkdir -p documentation/security-watch mode="${MODE:-run}" [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run echo "mode: $mode" case "$mode" in test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;; dry) extra="--no-mail" ; state=/tmp/state-dry.json cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;; seed) extra="--seed" ; state=documentation/security-watch/state.json ;; run) extra="" ; state=documentation/security-watch/state.json ;; *) echo "unknown mode $mode"; exit 2 ;; esac python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \ --controller=../felhom-controller --json=/tmp/watch-results.json $extra shell: bash --noprofile --norc -e -o pipefail {0} env: RESEND_API_KEY: *** GH_ADVISORY_TOKEN: MODE: dry ::endgroup:: mode: dry /root/.cache/act/6ed0fc4eeecacefe/hostexecutor/scripts/security_watch.py:687: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC). today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date() security watch 2026-10-26: 108 pins (11 box/build, 97 app); GitHub key ABSENT — apps' advisories in a 2-night rotation ADVISORY box cloudflare/cloudflared 2026.10.3 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.4:VULN-176088 (fixed 2026.10.4) ADVISORY box gtstef/filebrowser 1.5.6-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more ADVISORY box traefik v3.7.13 GHSA-hrpp-p4fc-wwf8 (fixed v3.7.16); GHSA-p8wx-ph99-xgcr (fixed v3.7.15); GHSA-fh26-gfpp-7xxx (fixed v3.7.14); GHSA-qvj7-gq9c-hp7q (fixed v3.7.14); … 11 more ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0) ADVISORY app ghcr.io/sysadminsmedia/homebox 0.26.2 release:sysadminsmedia/homebox@v0.27.1 (fixed v0.27.1); release:sysadminsmedia/homebox@v0.27.0 (fixed v0.27.0) ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 release:TandoorRecipes/recipes@2.7.0 (fixed 2.7.0) ADVISORY app grafana/grafana 13.2.3 release:grafana/grafana@v13.2.4 (fixed v13.2.4) ADVISORY app lscr.io/linuxserver/bookstack 26.09.1 release:BookStackApp/BookStack@v26.09.2 (fixed v26.09.2) ADVISORY app lscr.io/linuxserver/code-server 4.129.0 release:coder/code-server@v4.141.1 (fixed v4.141.1) ADVISORY app outlinewiki/outline 1.10.1 release:outline/outline@v1.12.0 (fixed v1.12.0) ADVISORY app privatebin/pdo 2.0.6 release:PrivateBin/PrivateBin@2.1.0 (fixed 2.1.0) ADVISORY app rommapp/romm 5.3.1 release:rommapp/romm@5.4.1 (fixed 5.4.1); release:rommapp/romm@5.4.0 (fixed 5.4.0) ADVISORY app vikunja/vikunja 2.6.0 release:go-vikunja/vikunja@v2.7.1 (fixed v2.7.1); release:go-vikunja/vikunja@v2.7.0 (fixed v2.7.0) NOT CHECKED app codewithcj/sparkyfitness v0.17.3 GitHub API rate limit reached earlier tonight NOT CHECKED app codewithcj/sparkyfitness_server v0.17.3 GitHub API rate limit reached earlier tonight NOT CHECKED app crocodilestick/calibre-web-automated v4.0.8 GitHub API rate limit reached earlier tonight NOT CHECKED app docmost/docmost 0.96.0 GitHub API rate limit reached earlier tonight NOT CHECKED app f0rc3/gokapi v1.9.6 GitHub API rate limit reached earlier tonight NOT CHECKED app fallenbagel/jellyseerr 2.7.3 GitHub API rate limit reached earlier tonight NOT CHECKED app flomp/wanderer-db v0.20.0 GitHub API rate limit reached earlier tonight NOT CHECKED app flomp/wanderer-web v0.20.0 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/advplyr/audiobookshelf 2.37.1 GitHub API rate limit (403) NOT CHECKED app ghcr.io/alam00000/bentopdf v2.8.6 GitHub API rate limit (403) NOT CHECKED app ghcr.io/cmintey/wishlist v0.67.1 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/gramps-project/grampsweb v25.6.0 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/grimmory-tools/grimmory v3.5.0 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/hargata/lubelogger v1.7.3 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/home-assistant/home-assistant 2026.9.4 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/immich-app/immich-machine-learning v3.2.4 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/immich-app/immich-server v3.2.4 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/karakeep-app/karakeep 0.33.2 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/kozea/radicale 3.8.1 GitHub API rate limit reached earlier tonight NOT CHECKED app ghcr.io/seanmorley15/adventurelog-backend v0.13.0 GitHub API rate limit (403) NOT CHECKED app jellyfin/jellyfin 10.11.11 GitHub API rate limit reached earlier tonight NOT CHECKED app kimai/kimai2 2.67.0 GitHub API rate limit reached earlier tonight NOT CHECKED app louislam/uptime-kuma 2.5.5 GitHub API rate limit reached earlier tonight NOT CHECKED app lscr.io/linuxserver/grocy 4.7.1 GitHub API rate limit reached earlier tonight NOT CHECKED app lscr.io/linuxserver/sonarr 4.0.20 GitHub API rate limit reached earlier tonight NOT CHECKED app lukevella/rallly 4.15.3 GitHub API rate limit reached earlier tonight NOT CHECKED app msdeluise/plant-it 0.10.0 GitHub API rate limit reached earlier tonight; Docker registry tags of msdeluise/plant-it: HTTP 401 NOT CHECKED app nextcloud 34.0.4-apache GitHub API rate limit reached earlier tonight; GitHub API rate limit reached earlier tonight NOT CHECKED app onlyoffice/documentserver 9.4.0 GitHub API rate limit reached earlier tonight NOT CHECKED app qbittorrentofficial/qbittorrent-nox 5.2.4-1 GitHub API rate limit reached earlier tonight BEHIND app actualbudget/actual-server 26.9.0 newest 26.10.0 BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0 BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0 BEHIND app ghcr.io/alexta69/metube 2026.09.29 newest 2026.10.25 BEHIND app ghcr.io/lukegus/termix 2.8.0 newest 2.9.2 BEHIND app ghcr.io/mealie-recipes/mealie v3.28.0 newest v3.29.0 BEHIND app ghcr.io/papra-hq/papra 26.6.2-rootless newest 26.7.1-rootless BEHIND app ghost 6.67.0-alpine newest 6.72.0-alpine BEHIND app glanceapp/glance v0.8.5 newest v0.8.7 BEHIND app gotson/komga 1.28.0 newest 1.29.1 BEHIND app n8nio/n8n 2.42.1 newest 2.45.4 BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine GAP buil alpine 3.24.2 newest 3.24.3 GAP buil alpine 3.24.2 newest 3.24.3 GAP buil debian 13.7-slim GAP buil debian 13.7-slim GAP app emby/embyserver 4.11.0.4 newest 4.11.0.10 GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1 GAP app mariadb 12.3 GAP app mariadb 11.4 newest 11.8 GAP app mariadb 11.8 GAP app mariadb 12.3 GAP app mariadb 11.8 GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0 GAP app postgis/postgis 16-3.5-alpine GAP app postgis/postgis 17-3.5-alpine GAP app postgres 18-alpine GAP app postgres 17-alpine GAP app postgres 18-alpine GAP app postgres 18-alpine GAP app postgres 18-alpine GAP app postgres 18-alpine GAP app postgres 18-alpine GAP app postgres 17-alpine GAP app postgres 16-alpine GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0 FLOATING app ghcr.io/claperco/claper 2.5 FLOATING app ghcr.io/thomiceli/opengist 1.15 FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623 FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3 FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0 FLOATING app nzbgetcom/nzbget v26.3 FLOATING app redis 7.4-alpine FLOATING app redis 7-alpine FLOATING app redis 7-alpine FLOATING app redis 7-alpine FLOATING app redis 7-alpine FLOATING app redis 7-alpine FLOATING app redis 7-alpine FLOATING app wger/server 2.7 SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0 SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11 CURRENT buil golang 1.27.3-trixie CURRENT buil golang 1.27.3-alpine3.24 CURRENT buil restic 0.19.1 CURRENT app calcom/cal.com v6.2.0 CURRENT app deluan/navidrome 0.64.2 CURRENT app ghcr.io/diced/zipline 4.8.0 CURRENT app ghcr.io/gethomepage/homepage v1.13.2 CURRENT app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 CURRENT app gitea/gitea 1.27.3 CURRENT app lscr.io/linuxserver/radarr 6.4.4 CURRENT app vaultwarden/server 1.37.4-alpine COUNTS ADVISORY=13 BEHIND=12 CURRENT=12 FLOATING=14 GAP=25 NOT_CHECKED=30 SELF=2 REQUESTS api.github.com=8 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=52 github.com=34 hub.docker.com=145 raw.githubusercontent.com=1 registry-1.docker.io=1 WOULD HAVE MAILED (seed): [Felhom security] cloudflared, filebrowser, traefik, dawarich … — 66 new advisories The nightly security watch (felhom.eu R-1303) found a notice that affects a version we ship. Box programs first. cloudflare/cloudflared — feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 What: 8 eMudhra certificates are compromised. Here's what you need to know Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage) Fixed in: read the notice Severity: not given Source: vendor notice (cloudflare-blog) Link: https://blog.cloudflare.com/emudhra-certificate-compromise/ Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release cloudflare/cloudflared — vulnnotes:cloudflared@2026.10.4:VULN-176088 What: - 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage) Fixed in: 2026.10.4 Severity: not given Source: release notes (cloudflared) Link: https://raw.githubusercontent.com/cloudflare/cloudflared/master/RELEASE_NOTES Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-26fh-r34c-qxh6 What: Moving or renaming a folder retargets public shares to the whole folder Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.2-stable, 2.1.3-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-26fh-r34c-qxh6 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-3846-gh75-gp3m What: Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override) Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 1.5.7-stable, 2.0.8-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3846-gh75-gp3m Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-3j46-5w28-f8p2 What: Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.1.0-stable, 2.1.3-beta Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3j46-5w28-f8p2 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-4fhx-8pf6-5gmr What: Duplicate finder can show another user’s restricted file names from a shared cache Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.2-stable, 2.1.3-beta Severity: low Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4fhx-8pf6-5gmr Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-4v62-884x-2466 What: Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.1.0-stable, 2.1.3-beta Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4v62-884x-2466 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-4vrc-935w-xxq2 What: Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonicalization Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.1.0-stable, 2.1.3-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4vrc-935w-xxq2 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-4wmj-rq3c-m65v What: Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken` Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: >= 2.0.1-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4wmj-rq3c-m65v Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-55mw-cwg7-m8f5 What: `GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.5-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-55mw-cwg7-m8f5 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-6gr6-5qpq-888p What: Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.10-beta Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-6gr6-5qpq-888p Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-8655-2ph3-q7q7 What: Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.2-stable, 2.1.3-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8655-2ph3-q7q7 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-8m35-wcjh-95q7 What: Logout Bypass via Alternate JWT Spelling Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: >= 2.0.1-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8m35-wcjh-95q7 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-9fcr-gm58-p839 What: Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.1.0-stable, 2.1.3-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9fcr-gm58-p839 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-9wm6-jcjh-3m8c What: Stored XSS via Unsanitized DOCX Hyperlink in DocViewer Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: >=2.0.1-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9wm6-jcjh-3m8c Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-c7pj-xjp9-x4xp What: Read-only users can overwrite files through PUT /api/resources Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.0-stable Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c7pj-xjp9-x4xp Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-c84q-q5g6-r47f What: createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write) Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.1-stable, 2.1.2-beta Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c84q-q5g6-r47f Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-c9cr-w724-gqj3 What: Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.1-stable Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c9cr-w724-gqj3 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-cw65-p35p-633w What: FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory) Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: >= 2.0.0-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-cw65-p35p-633w Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-g2q5-r6ch-v25f What: FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj) Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.1.0-stable, 2.1.3-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-g2q5-r6ch-v25f Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-gfgm-886h-6r47 What: Custom API token with no global caps inherits owner admin access Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.2-stable, 2.1.4-beta Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-gfgm-886h-6r47 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-mgqf-5mf5-prfj What: Symlink following escapes user scope allowing arbitrary file read outside the served directory Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: >= 2.0.1-beta Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-p7x3-p5jj-9xfh What: Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.0-stable, 2.0.10-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p7x3-p5jj-9xfh Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-p93p-v944-4p44 What: Unarchive writes into folders denied by access rules and overwrites files without modify permission Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.1.0-stable, 2.1.3-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p93p-v944-4p44 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-p9wm-f5jj-75pj What: FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.2-stable, 2.1.3-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p9wm-f5jj-75pj Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-qqf3-2wvq-q4w9 What: Archive download follows symlinks out of source scope (arbitrary file read) Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.1.0-stable, 2.1.3-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqf3-2wvq-q4w9 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-qv53-4557-m65h What: Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: >= v2.0.0-beta Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qv53-4557-m65h Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-qx86-4v5r-26g5 What: MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`) Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 1.5.7-stable, 2.0.10-beta Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qx86-4v5r-26g5 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-r744-4vm3-2px3 What: Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and password changes Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.2-stable, 2.1.3-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r744-4vm3-2px3 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-rmjp-pfrq-cc3v What: Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: 2.0.2-stable, 2.1.3-beta Severity: high Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rmjp-pfrq-cc3v Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-rqqq-wv83-rp74 What: Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage) Fixed in: >= v2.0.1-beta Severity: medium Source: GitHub advisory Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rqqq-wv83-rp74 Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release gtstef/filebrowser — GHSA-vvm6-jwrf-hgmg What: Stored XSS via HTML Preview — `