admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
3c8c1ded1ffce3fdd9e82c17e0eb5f3ef1950eaa
felhom.eu/documentation/audits/security-watch-2026-10-26/ci-seed.log
T

1479 lines
92 KiB
Plaintext
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
felhom-gates-runner-2(version:v0.6.1) received task 2430 of job watch, be triggered by event: workflow_dispatch
workflow prepared
evaluating expression 'success()'
expression 'success()' evaluated to 'true'
evaluating expression ''
expression '' evaluated to 'true'
⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
base=http://gitea.gitea-system.svc.cluster.local:3000/admin
git init -q . && git remote add origin $base/felhom.eu.git
git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
for r in felhom-controller app-catalog-felhom.eu; do
git init -q ../$r && git -C ../$r remote add origin $base/$r.git
git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
done
shell: bash --noprofile --norc -e -o pipefail {0}
::endgroup::
felhom.eu main at 6ee23a3b8f90
felhom-controller at e01eb64b2591
app-catalog-felhom.eu at f61800aae945
::group::Run set -u
set -u
mkdir -p documentation/security-watch
mode="${MODE:-run}"
[ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
echo "mode: $mode"
case "$mode" in
test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
dry) extra="--no-mail" ; state=/tmp/state-dry.json
cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
run) extra="" ; state=documentation/security-watch/state.json ;;
*) echo "unknown mode $mode"; exit 2 ;;
esac
python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
--controller=../felhom-controller --json=/tmp/watch-results.json $extra
shell: bash --noprofile --norc -e -o pipefail {0}
env:
RESEND_API_KEY: ***
GH_ADVISORY_TOKEN:
MODE: seed
::endgroup::
mode: seed
/root/.cache/act/33378d3d739c1729/hostexecutor/scripts/security_watch.py:715: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
security watch 2026-10-26: 108 pins (11 box/build, 97 app); GitHub key ABSENT — apps' advisories in a 2-night rotation
ADVISORY box cloudflare/cloudflared 2026.10.3 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.4:VULN-176088 (fixed 2026.10.4)
ADVISORY box gtstef/filebrowser 1.5.6-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more
ADVISORY box traefik v3.7.13 GHSA-hrpp-p4fc-wwf8 (fixed v3.7.16); GHSA-p8wx-ph99-xgcr (fixed v3.7.15); GHSA-fh26-gfpp-7xxx (fixed v3.7.14); GHSA-qvj7-gq9c-hp7q (fixed v3.7.14); … 11 more
ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed no fixed version named yet); GHSA-cmmf-53wf-r5gv (fixed no fixed version named yet); GHSA-p8cf-g8rv-gvrq (fixed no fixed version named yet)
ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed no fixed version named yet); GHSA-cmmf-53wf-r5gv (fixed no fixed version named yet); GHSA-p8cf-g8rv-gvrq (fixed no fixed version named yet)
ADVISORY app docmost/docmost 0.96.0 release:docmost/docmost@v0.97.0 (fixed v0.97.0)
ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more
ADVISORY app fallenbagel/jellyseerr 2.7.3 GHSA-8j73-j6rc-q8xh (fixed 3.5.0); GHSA-xc6j-6p6h-p799 (fixed 3.5.0); GHSA-mc6w-69r3-62h8 (fixed 3.4.0); GHSA-gx3h-3jg5-q65f (fixed 3.1.0); … 2 more
ADVISORY app flomp/wanderer-db v0.20.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 7 more
ADVISORY app flomp/wanderer-web v0.20.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 7 more
ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0)
ADVISORY app ghcr.io/advplyr/audiobookshelf 2.37.1 release:advplyr/audiobookshelf@v2.37.2 (fixed v2.37.2)
ADVISORY app ghcr.io/alam00000/bentopdf v2.8.6 GHSA-wh78-rcw2-hhg9 (fixed v2.8.7); GHSA-5xjf-rr5x-pcfj (fixed no fixed version named yet); GHSA-cx8x-7rrr-r9x8 (fixed no fixed version named yet); release:alam00000/bentopdf@v2.8.10 (fixed v2.8.10); … 1 more
ADVISORY app ghcr.io/cmintey/wishlist v0.67.1 release:cmintey/wishlist@v0.69.0 (fixed v0.69.0); release:cmintey/wishlist@v0.68.0 (fixed v0.68.0)
ADVISORY app ghcr.io/home-assistant/home-assistant 2026.9.4 GHSA-jff5-5j3g-vhqc (fixed the range is unreadable — check by hand)
ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.2.4 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand); release:immich-app/immich@v3.3.5 (fixed v3.3.5)
ADVISORY app ghcr.io/immich-app/immich-server v3.2.4 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand); release:immich-app/immich@v3.3.5 (fixed v3.3.5)
ADVISORY app ghcr.io/karakeep-app/karakeep 0.33.2 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet); release:karakeep-app/karakeep@v0.34.1 (fixed v0.34.1); release:karakeep-app/karakeep@v0.34.0 (fixed v0.34.0)
ADVISORY app ghcr.io/sysadminsmedia/homebox 0.26.2 release:sysadminsmedia/homebox@v0.27.1 (fixed v0.27.1); release:sysadminsmedia/homebox@v0.27.0 (fixed v0.27.0)
ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 release:TandoorRecipes/recipes@2.7.0 (fixed 2.7.0)
ADVISORY app grafana/grafana 13.2.3 release:grafana/grafana@v13.2.4 (fixed v13.2.4)
ADVISORY app jellyfin/jellyfin 10.11.11 GHSA-cf3c-8m59-2vhx (fixed 12.0); GHSA-6828-c7cx-hvqm (fixed 12.0); GHSA-4vx8-xhc9-qg6x (fixed 12.0); GHSA-9x85-gx46-6522 (fixed 12.0); … 2 more
ADVISORY app louislam/uptime-kuma 2.5.5 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); release:louislam/uptime-kuma@2.5.6 (fixed 2.5.6)
ADVISORY app lscr.io/linuxserver/bookstack 26.09.1 release:BookStackApp/BookStack@v26.09.2 (fixed v26.09.2)
ADVISORY app lscr.io/linuxserver/code-server 4.129.0 release:coder/code-server@v4.141.1 (fixed v4.141.1)
ADVISORY app lukevella/rallly 4.15.3 GHSA-gmq4-f8j5-8w8q (fixed 4.15.4); release:lukevella/rallly@v4.16.2 (fixed v4.16.2); release:lukevella/rallly@v4.16.0 (fixed v4.16.0); release:lukevella/rallly@v4.15.5 (fixed v4.15.5); … 1 more
ADVISORY app outlinewiki/outline 1.10.1 release:outline/outline@v1.12.0 (fixed v1.12.0)
ADVISORY app privatebin/pdo 2.0.6 release:PrivateBin/PrivateBin@2.1.0 (fixed 2.1.0)
ADVISORY app rommapp/romm 5.3.1 release:rommapp/romm@5.4.1 (fixed 5.4.1); release:rommapp/romm@5.4.0 (fixed 5.4.0)
ADVISORY app vikunja/vikunja 2.6.0 release:go-vikunja/vikunja@v2.7.1 (fixed v2.7.1); release:go-vikunja/vikunja@v2.7.0 (fixed v2.7.0)
BEHIND app actualbudget/actual-server 26.9.0 newest 26.10.0
BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
BEHIND app ghcr.io/alexta69/metube 2026.09.29 newest 2026.10.25
BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
BEHIND app ghcr.io/lukegus/termix 2.8.0 newest 2.9.2
BEHIND app ghcr.io/mealie-recipes/mealie v3.28.0 newest v3.29.0
BEHIND app ghcr.io/papra-hq/papra 26.6.2-rootless newest 26.7.1-rootless
BEHIND app ghost 6.67.0-alpine newest 6.72.0-alpine
BEHIND app glanceapp/glance v0.8.5 newest v0.8.7
BEHIND app gotson/komga 1.28.0 newest 1.29.1
BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
BEHIND app n8nio/n8n 2.42.1 newest 2.45.4
BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
GAP buil alpine 3.24.2 newest 3.24.3
GAP buil alpine 3.24.2 newest 3.24.3
GAP buil debian 13.7-slim
GAP buil debian 13.7-slim
GAP app emby/embyserver 4.11.0.4 newest 4.11.0.10
GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
GAP app mariadb 12.3
GAP app mariadb 11.4 newest 11.8
GAP app mariadb 11.8
GAP app mariadb 12.3
GAP app mariadb 11.8
GAP app msdeluise/plant-it 0.10.0
GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
GAP app postgis/postgis 16-3.5-alpine
GAP app postgis/postgis 17-3.5-alpine
GAP app postgres 18-alpine
GAP app postgres 17-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 17-alpine
GAP app postgres 16-alpine
GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
FLOATING app ghcr.io/claperco/claper 2.5
FLOATING app ghcr.io/thomiceli/opengist 1.15
FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
FLOATING app nzbgetcom/nzbget v26.3
FLOATING app redis 7.4-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app wger/server 2.7
SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
CURRENT buil golang 1.27.3-trixie
CURRENT buil golang 1.27.3-alpine3.24
CURRENT buil restic 0.19.1
CURRENT app calcom/cal.com v6.2.0
CURRENT app crocodilestick/calibre-web-automated v4.0.8
CURRENT app deluan/navidrome 0.64.2
CURRENT app ghcr.io/diced/zipline 4.8.0
CURRENT app ghcr.io/gethomepage/homepage v1.13.2
CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
CURRENT app ghcr.io/paperless-ngx/paperless-ngx 2.20.15
CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.0
CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0
CURRENT app gitea/gitea 1.27.3
CURRENT app lscr.io/linuxserver/grocy 4.7.1
CURRENT app lscr.io/linuxserver/radarr 6.4.4
CURRENT app lscr.io/linuxserver/sonarr 4.0.20
CURRENT app onlyoffice/documentserver 9.4.0
CURRENT app vaultwarden/server 1.37.4-alpine
COUNTS ADVISORY=30 BEHIND=17 CURRENT=19 FLOATING=14 GAP=26 SELF=2
REQUESTS api.github.com=37 api.osv.dev=1 blog.cloudflare.com=1 ghcr.io=52 github.com=63 hub.docker.com=144 raw.githubusercontent.com=1
WOULD HAVE MAILED (seed): [Felhom security] cloudflared, filebrowser, traefik, sparkyfitness … — 142 new advisories
The nightly security watch (felhom.eu R-1303) found a notice that affects a version we ship.
Box programs first.
cloudflare/cloudflared — feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3
What: 8 eMudhra certificates are compromised. Here's what you need to know
Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage)
Fixed in: read the notice
Severity: not given
Source: vendor notice (cloudflare-blog)
Link: https://blog.cloudflare.com/emudhra-certificate-compromise/
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
cloudflare/cloudflared — vulnnotes:cloudflared@2026.10.4:VULN-176088
What: - 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server
Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage)
Fixed in: 2026.10.4
Severity: not given
Source: release notes (cloudflared)
Link: https://raw.githubusercontent.com/cloudflare/cloudflared/master/RELEASE_NOTES
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-26fh-r34c-qxh6
What: Moving or renaming a folder retargets public shares to the whole folder
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-26fh-r34c-qxh6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-3846-gh75-gp3m
What: Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 1.5.7-stable, 2.0.8-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3846-gh75-gp3m
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-3j46-5w28-f8p2
What: Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3j46-5w28-f8p2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-4fhx-8pf6-5gmr
What: Duplicate finder can show another user’s restricted file names from a shared cache
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: low
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4fhx-8pf6-5gmr
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-4v62-884x-2466
What: Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4v62-884x-2466
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-4vrc-935w-xxq2
What: Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonicalization
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4vrc-935w-xxq2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-4wmj-rq3c-m65v
What: Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.1-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4wmj-rq3c-m65v
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-55mw-cwg7-m8f5
What: `GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.5-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-55mw-cwg7-m8f5
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-6gr6-5qpq-888p
What: Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.10-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-6gr6-5qpq-888p
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-8655-2ph3-q7q7
What: Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8655-2ph3-q7q7
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-8m35-wcjh-95q7
What: Logout Bypass via Alternate JWT Spelling
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.1-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8m35-wcjh-95q7
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-9fcr-gm58-p839
What: Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9fcr-gm58-p839
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-9wm6-jcjh-3m8c
What: Stored XSS via Unsanitized DOCX Hyperlink in DocViewer
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >=2.0.1-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9wm6-jcjh-3m8c
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-c7pj-xjp9-x4xp
What: Read-only users can overwrite files through PUT /api/resources
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.0-stable
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c7pj-xjp9-x4xp
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-c84q-q5g6-r47f
What: createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.1-stable, 2.1.2-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c84q-q5g6-r47f
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-c9cr-w724-gqj3
What: Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.1-stable
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c9cr-w724-gqj3
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-cw65-p35p-633w
What: FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.0-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-cw65-p35p-633w
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-g2q5-r6ch-v25f
What: FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-g2q5-r6ch-v25f
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-gfgm-886h-6r47
What: Custom API token with no global caps inherits owner admin access
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.4-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-gfgm-886h-6r47
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-mgqf-5mf5-prfj
What: Symlink following escapes user scope allowing arbitrary file read outside the served directory
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.1-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-p7x3-p5jj-9xfh
What: Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.0-stable, 2.0.10-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p7x3-p5jj-9xfh
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-p93p-v944-4p44
What: Unarchive writes into folders denied by access rules and overwrites files without modify permission
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p93p-v944-4p44
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-p9wm-f5jj-75pj
What: FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p9wm-f5jj-75pj
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-qqf3-2wvq-q4w9
What: Archive download follows symlinks out of source scope (arbitrary file read)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqf3-2wvq-q4w9
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-qv53-4557-m65h
What: Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= v2.0.0-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qv53-4557-m65h
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-qx86-4v5r-26g5
What: MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 1.5.7-stable, 2.0.10-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qx86-4v5r-26g5
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-r744-4vm3-2px3
What: Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and password changes
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r744-4vm3-2px3
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-rmjp-pfrq-cc3v
What: Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rmjp-pfrq-cc3v
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-rqqq-wv83-rp74
What: Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= v2.0.1-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rqqq-wv83-rp74
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-vvm6-jwrf-hgmg
What: Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.3-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvm6-jwrf-hgmg
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-wfjp-qhvc-69wp
What: Share path re-point allows scope escape (arbitrary read/write across the source root)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.0-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wfjp-qhvc-69wp
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-wjp8-g49g-xrhx
What: Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: low
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wjp8-g49g-xrhx
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-wxj5-g3qp-g732
What: Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/api/resources/view)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wxj5-g3qp-g732
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-x79q-5hqm-x839
What: Share authorization gaps let read-only users delete files
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.0-stable
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-x79q-5hqm-x839
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — release:gtsteffaniak/filebrowser@v1.5.7-stable
What: [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; res
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: v1.5.7-stable
Severity: not given
Source: release notes
Link: https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.7-stable
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — release:gtsteffaniak/filebrowser@v1.5.8-stable
What: [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; res
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: v1.5.8-stable
Severity: not given
Source: release notes
Link: https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.8-stable
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-28hp-c82p-8vqj
What: Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.15
Severity: low
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-53qr-784g-cj35
What: FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-cw35-4q88-3rmp
What: Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-fh26-gfpp-7xxx
What: snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-hrpp-p4fc-wwf8
What: ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.16
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-mhjw-hmjv-p99x
What: Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: medium
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-mwrr-6hp4-pxr6
What: Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-p8wx-ph99-xgcr
What: ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.15
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-qm9f-w54v-q2qh
What: Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-qvj7-gq9c-hp7q
What: Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-rv2h-qh7j-xrjw
What: Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-ww7c-q3mv-xx22
What: Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.15
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — release:traefik/traefik@v3.7.14
What: Advisory GHSA-53qr-784g-cj35
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: not given
Source: release notes
Link: https://github.com/traefik/traefik/releases/tag/v3.7.14
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — release:traefik/traefik@v3.7.15
What: Advisory GHSA-p8wx-ph99-xgcr
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.15
Severity: not given
Source: release notes
Link: https://github.com/traefik/traefik/releases/tag/v3.7.15
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — release:traefik/traefik@v3.7.16
What: Advisory GHSA-hrpp-p4fc-wwf8
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.16
Severity: not given
Source: release notes
Link: https://github.com/traefik/traefik/releases/tag/v3.7.16
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
codewithcj/sparkyfitness — GHSA-cmmf-53wf-r5gv
What: Unauthenticated direct access to owner-only pregnancy photos through public static mounts
Our version: v0.17.3 (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness)
Fixed in: no fixed version named yet
Severity: low
Source: GitHub advisory
Link: https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-cmmf-53wf-r5gv
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
codewithcj/sparkyfitness — GHSA-p8cf-g8rv-gvrq
What: Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state
Our version: v0.17.3 (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness)
Fixed in: no fixed version named yet
Severity: medium
Source: GitHub advisory
Link: https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-p8cf-g8rv-gvrq
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
codewithcj/sparkyfitness — GHSA-v883-jx9h-qf29
What: Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a known, public session-signing/2FA-encryption key
Our version: v0.17.3 (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness)
Fixed in: no fixed version named yet
Severity: medium
Source: GitHub advisory
Link: https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-v883-jx9h-qf29
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
codewithcj/sparkyfitness_server — GHSA-cmmf-53wf-r5gv
What: Unauthenticated direct access to owner-only pregnancy photos through public static mounts
Our version: v0.17.3 (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness_server)
Fixed in: no fixed version named yet
Severity: low
Source: GitHub advisory
Link: https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-cmmf-53wf-r5gv
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
codewithcj/sparkyfitness_server — GHSA-p8cf-g8rv-gvrq
What: Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state
Our version: v0.17.3 (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness_server)
Fixed in: no fixed version named yet
Severity: medium
Source: GitHub advisory
Link: https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-p8cf-g8rv-gvrq
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
codewithcj/sparkyfitness_server — GHSA-v883-jx9h-qf29
What: Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a known, public session-signing/2FA-encryption key
Our version: v0.17.3 (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness_server)
Fixed in: no fixed version named yet
Severity: medium
Source: GitHub advisory
Link: https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-v883-jx9h-qf29
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
docmost/docmost — release:docmost/docmost@v0.97.0
What: This release includes security fixes for the latest Node
Our version: 0.96.0 (docmost; templates/docmost/.felhom.yml upstream: docmost/docmost)
Fixed in: v0.97.0
Severity: not given
Source: release notes
Link: https://github.com/docmost/docmost/releases/tag/v0.97.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-3c22-5j5m-4jq7
What: Stored XSS in SVG Hotlinks
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: 2.2.3
Severity: high
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-3c22-5j5m-4jq7
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-45vh-rpc8-hxpp
What: File Request MaxSize Limit Bypassed in File Request
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: 2.2.4
Severity: medium
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-4xg4-54hm-9j77
What: Stored XSS vulnerability in friendly name for API keys
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: v2.0.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-4xg4-54hm-9j77
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-95rc-wc32-gm53
What: Stored XSS by uploading file with malicious file name
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: v2.0.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-95rc-wc32-gm53
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-c36c-7pc2-f2ph
What: Data Leak in Upload Status Stream
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: 2.2.3
Severity: medium
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-c36c-7pc2-f2ph
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-hcff-qv74-7hr4
What: CSRF in Login Endpoint
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: 2.2.3
Severity: medium
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-hcff-qv74-7hr4
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-j6jp-78w8-34x6
What: Privilege Escalation in File Replace
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: 2.2.4
Severity: medium
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-j6jp-78w8-34x6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-m2hx-wjxc-9fp4
What: Privilege escalation with auth token
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: 2.2.3
Severity: medium
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-m2hx-wjxc-9fp4
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-q658-hfpg-35qc
What: Privilege escalation via incomplete API-key permission revocation on user rank demotion
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: 2.2.3
Severity: medium
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-q658-hfpg-35qc
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
f0rc3/gokapi — GHSA-qwc6-vc2v-2ggj
What: DoS in API endpoint
Our version: v1.9.6 (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
Fixed in: 2.2.4
Severity: medium
Source: GitHub advisory
Link: https://github.com/Forceu/Gokapi/security/advisories/GHSA-qwc6-vc2v-2ggj
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
fallenbagel/jellyseerr — GHSA-8j73-j6rc-q8xh
What: Third-party notification credentials of other users exposed via request detail endpoints
Our version: 2.7.3 (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
Fixed in: 3.5.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/seerr-team/seerr/security/advisories/GHSA-8j73-j6rc-q8xh
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
fallenbagel/jellyseerr — GHSA-f7xw-jcqr-57hp
What: Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification Credentials
Our version: 2.7.3 (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
Fixed in: 3.1.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/seerr-team/seerr/security/advisories/GHSA-f7xw-jcqr-57hp
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
fallenbagel/jellyseerr — GHSA-gx3h-3jg5-q65f
What: Missing authentication on pushSubscription endpoints
Our version: 2.7.3 (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
Fixed in: 3.1.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
fallenbagel/jellyseerr — GHSA-mc6w-69r3-62h8
What: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag
Our version: 2.7.3 (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
Fixed in: 3.4.0
Severity: high
Source: GitHub advisory
Link: https://github.com/seerr-team/seerr/security/advisories/GHSA-mc6w-69r3-62h8
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
fallenbagel/jellyseerr — GHSA-rc4w-7m3r-c2f7
What: Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpoint
Our version: 2.7.3 (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
Fixed in: 3.1.0
Severity: high
Source: GitHub advisory
Link: https://github.com/seerr-team/seerr/security/advisories/GHSA-rc4w-7m3r-c2f7
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
fallenbagel/jellyseerr — GHSA-xc6j-6p6h-p799
What: Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo
Our version: 2.7.3 (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
Fixed in: 3.5.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/seerr-team/seerr/security/advisories/GHSA-xc6j-6p6h-p799
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — GHSA-332v-mq7g-5hqf
What: Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed to another user
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-332v-mq7g-5hqf
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — GHSA-3xp7-7492-j2q6
What: ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.2
Severity: medium
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-3xp7-7492-j2q6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — GHSA-8j93-xvwx-jjg3
What: SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.0
Severity: high
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-8j93-xvwx-jjg3
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — GHSA-fprh-3pp9-68m9
What: ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (incomplete fix of GHSA-xcwc-jhv2-w4h6)
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.2
Severity: critical
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-fprh-3pp9-68m9
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — GHSA-j9m4-8qwf-jvx6
What: SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.2
Severity: high
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-j9m4-8qwf-jvx6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — GHSA-mr29-2qg5-m4fw
What: ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.0
Severity: high
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-mr29-2qg5-m4fw
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — GHSA-vj82-xj83-jp85
What: wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any other user's trail
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-vj82-xj83-jp85
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — GHSA-vprp-gr6m-j375
What: ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.2
Severity: medium
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-vprp-gr6m-j375
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — GHSA-xcwc-jhv2-w4h6
What: ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.0
Severity: high
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-xcwc-jhv2-w4h6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — release:open-wanderer/wanderer@v0.21.0
What: Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.0
Severity: not given
Source: release notes
Link: https://github.com/open-wanderer/wanderer/releases/tag/v0.21.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-db — release:open-wanderer/wanderer@v0.21.2
What: ( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
Fixed in: v0.21.2
Severity: not given
Source: release notes
Link: https://github.com/open-wanderer/wanderer/releases/tag/v0.21.2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — GHSA-332v-mq7g-5hqf
What: Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed to another user
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-332v-mq7g-5hqf
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — GHSA-3xp7-7492-j2q6
What: ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.2
Severity: medium
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-3xp7-7492-j2q6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — GHSA-8j93-xvwx-jjg3
What: SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.0
Severity: high
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-8j93-xvwx-jjg3
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — GHSA-fprh-3pp9-68m9
What: ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (incomplete fix of GHSA-xcwc-jhv2-w4h6)
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.2
Severity: critical
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-fprh-3pp9-68m9
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — GHSA-j9m4-8qwf-jvx6
What: SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.2
Severity: high
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-j9m4-8qwf-jvx6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — GHSA-mr29-2qg5-m4fw
What: ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.0
Severity: high
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-mr29-2qg5-m4fw
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — GHSA-vj82-xj83-jp85
What: wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any other user's trail
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-vj82-xj83-jp85
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — GHSA-vprp-gr6m-j375
What: ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.2
Severity: medium
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-vprp-gr6m-j375
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — GHSA-xcwc-jhv2-w4h6
What: ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.0
Severity: high
Source: GitHub advisory
Link: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-xcwc-jhv2-w4h6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — release:open-wanderer/wanderer@v0.21.0
What: Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.0
Severity: not given
Source: release notes
Link: https://github.com/open-wanderer/wanderer/releases/tag/v0.21.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
flomp/wanderer-web — release:open-wanderer/wanderer@v0.21.2
What: ( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )
Our version: v0.20.0 (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
Fixed in: v0.21.2
Severity: not given
Source: release notes
Link: https://github.com/open-wanderer/wanderer/releases/tag/v0.21.2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
freikin/dawarich — release:Freika/dawarich@1.17.0
What: js 20 package, which no longer receives upstream security fixes
Our version: 1.15.3 (dawarich; templates/dawarich/.felhom.yml upstream: freikin/dawarich)
Fixed in: 1.17.0
Severity: not given
Source: release notes
Link: https://github.com/Freika/dawarich/releases/tag/1.17.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/advplyr/audiobookshelf — release:advplyr/audiobookshelf@v2.37.2
What: 1 (October 2026 security release)
Our version: 2.37.1 (audiobookshelf; templates/audiobookshelf/.felhom.yml upstream: ghcr.io/advplyr/audiobookshelf)
Fixed in: v2.37.2
Severity: not given
Source: release notes
Link: https://github.com/advplyr/audiobookshelf/releases/tag/v2.37.2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/alam00000/bentopdf — GHSA-5xjf-rr5x-pcfj
What: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass
Our version: v2.8.6 (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
Fixed in: no fixed version named yet
Severity: medium
Source: GitHub advisory
Link: https://github.com/alam00000/bentopdf/security/advisories/GHSA-5xjf-rr5x-pcfj
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/alam00000/bentopdf — GHSA-cx8x-7rrr-r9x8
What: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests
Our version: v2.8.6 (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
Fixed in: no fixed version named yet
Severity: low
Source: GitHub advisory
Link: https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/alam00000/bentopdf — GHSA-wh78-rcw2-hhg9
What: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker
Our version: v2.8.6 (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
Fixed in: v2.8.7
Severity: medium
Source: GitHub advisory
Link: https://github.com/alam00000/bentopdf/security/advisories/GHSA-wh78-rcw2-hhg9
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/alam00000/bentopdf — release:alam00000/bentopdf@v2.8.10
What: Warning This release addresses security vulnerabilities ( GHSA-v77x-cvmx-ggp4 , GHSA-qch9-77q9-j7p6 ) affecting all versions up to and including v2
Our version: v2.8.6 (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
Fixed in: v2.8.10
Severity: not given
Source: release notes
Link: https://github.com/alam00000/bentopdf/releases/tag/v2.8.10
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/alam00000/bentopdf — release:alam00000/bentopdf@v2.8.7
What: Warning This release addresses security vulnerabilities ( GHSA-wh78-rcw2-hhg9 , GHSA-5xjf-rr5x-pcfj , GHSA-cx8x-7rrr-r9x8 ) affecting all versions up to and including v2
Our version: v2.8.6 (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
Fixed in: v2.8.7
Severity: not given
Source: release notes
Link: https://github.com/alam00000/bentopdf/releases/tag/v2.8.7
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/cmintey/wishlist — release:cmintey/wishlist@v0.68.0
What: Update dependency nodemailer to v10 [SECURITY] by @renovate [bot] in #798
Our version: v0.67.1 (wishlist; templates/wishlist/.felhom.yml upstream: ghcr.io/cmintey/wishlist)
Fixed in: v0.68.0
Severity: not given
Source: release notes
Link: https://github.com/cmintey/wishlist/releases/tag/v0.68.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/cmintey/wishlist — release:cmintey/wishlist@v0.69.0
What: org/en/blog/vulnerability/october-2026-security-releases
Our version: v0.67.1 (wishlist; templates/wishlist/.felhom.yml upstream: ghcr.io/cmintey/wishlist)
Fixed in: v0.69.0
Severity: not given
Source: release notes
Link: https://github.com/cmintey/wishlist/releases/tag/v0.69.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/home-assistant/home-assistant — GHSA-jff5-5j3g-vhqc
What: Actions expression injection in `helpers/version/action.yml`
Our version: 2026.9.4 (home-assistant; templates/home-assistant/.felhom.yml upstream: ghcr.io/home-assistant/home-assistant)
Fixed in: the range is unreadable — check by hand
Severity: low
Source: GitHub advisory — the range could not be read; check by hand
Link: https://github.com/home-assistant/core/security/advisories/GHSA-jff5-5j3g-vhqc
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/immich-app/immich-machine-learning — GHSA-8244-8vpr-vp9c
What: One-click account takeover via XSS in login page continue redirect
Our version: v3.2.4 (immich; templates/immich/.felhom.yml upstream: ghcr.io/immich-app/immich-machine-learning)
Fixed in: the range is unreadable — check by hand
Severity: critical
Source: GitHub advisory — the range could not be read; check by hand
Link: https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/immich-app/immich-machine-learning — release:immich-app/immich@v3.3.5
What: com/ ) as well as some nodejs security patches
Our version: v3.2.4 (immich; templates/immich/.felhom.yml upstream: ghcr.io/immich-app/immich-machine-learning)
Fixed in: v3.3.5
Severity: not given
Source: release notes
Link: https://github.com/immich-app/immich/releases/tag/v3.3.5
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/immich-app/immich-server — GHSA-8244-8vpr-vp9c
What: One-click account takeover via XSS in login page continue redirect
Our version: v3.2.4 (immich; templates/immich/.felhom.yml upstream: ghcr.io/immich-app/immich-server)
Fixed in: the range is unreadable — check by hand
Severity: critical
Source: GitHub advisory — the range could not be read; check by hand
Link: https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/immich-app/immich-server — release:immich-app/immich@v3.3.5
What: com/ ) as well as some nodejs security patches
Our version: v3.2.4 (immich; templates/immich/.felhom.yml upstream: ghcr.io/immich-app/immich-server)
Fixed in: v3.3.5
Severity: not given
Source: release notes
Link: https://github.com/immich-app/immich/releases/tag/v3.3.5
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/karakeep-app/karakeep — GHSA-pp34-2c9r-mchw
What: karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV
Our version: 0.33.2 (karakeep; templates/karakeep/.felhom.yml upstream: ghcr.io/karakeep-app/karakeep)
Fixed in: no fixed version named yet
Severity: high
Source: GitHub advisory
Link: https://github.com/karakeep-app/karakeep/security/advisories/GHSA-pp34-2c9r-mchw
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/karakeep-app/karakeep — release:karakeep-app/karakeep@v0.34.0
What: 1 for its October security release ( #3196 )
Our version: 0.33.2 (karakeep; templates/karakeep/.felhom.yml upstream: ghcr.io/karakeep-app/karakeep)
Fixed in: v0.34.0
Severity: not given
Source: release notes
Link: https://github.com/karakeep-app/karakeep/releases/tag/v0.34.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/karakeep-app/karakeep — release:karakeep-app/karakeep@v0.34.1
What: This is a security release on top of 0
Our version: 0.33.2 (karakeep; templates/karakeep/.felhom.yml upstream: ghcr.io/karakeep-app/karakeep)
Fixed in: v0.34.1
Severity: not given
Source: release notes
Link: https://github.com/karakeep-app/karakeep/releases/tag/v0.34.1
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/sysadminsmedia/homebox — release:sysadminsmedia/homebox@v0.27.0
What: Security Issues Patched
Our version: 0.26.2 (homebox; templates/homebox/.felhom.yml upstream: ghcr.io/sysadminsmedia/homebox)
Fixed in: v0.27.0
Severity: not given
Source: release notes
Link: https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/sysadminsmedia/homebox — release:sysadminsmedia/homebox@v0.27.1
What: Warning This release is a security release to patch a NodeJS upstream vulnerability
Our version: 0.26.2 (homebox; templates/homebox/.felhom.yml upstream: ghcr.io/sysadminsmedia/homebox)
Fixed in: v0.27.1
Severity: not given
Source: release notes
Link: https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.1
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/tandoorrecipes/recipes — release:TandoorRecipes/recipes@2.7.0
What: fixed shopping list bulk API endpoint accepted IDs from foreign spaces GHSA-5p9v-743w-79h3
Our version: 2.6.15 (tandoor; templates/tandoor/.felhom.yml upstream: ghcr.io/tandoorrecipes/recipes)
Fixed in: 2.7.0
Severity: not given
Source: release notes
Link: https://github.com/TandoorRecipes/recipes/releases/tag/2.7.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
grafana/grafana — release:grafana/grafana@v13.2.4
What: Security: Fix CVE-2026-15577
Our version: 13.2.3 (grafana; templates/grafana/.felhom.yml upstream: grafana/grafana)
Fixed in: v13.2.4
Severity: not given
Source: release notes
Link: https://github.com/grafana/grafana/releases/tag/v13.2.4
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
jellyfin/jellyfin — GHSA-4vx8-xhc9-qg6x
What: Broken access control in session remote-control API
Our version: 10.11.11 (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
Fixed in: 12.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/jellyfin/jellyfin/security/advisories/GHSA-4vx8-xhc9-qg6x
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
jellyfin/jellyfin — GHSA-6828-c7cx-hvqm
What: Path traversal in the virtual-folder management endpoints allows deletion and relocation of arbitrary directories
Our version: 10.11.11 (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
Fixed in: 12.0
Severity: critical
Source: GitHub advisory
Link: https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
jellyfin/jellyfin — GHSA-9x85-gx46-6522
What: Potential IDOR in playlist management
Our version: 10.11.11 (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
Fixed in: 12.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9x85-gx46-6522
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
jellyfin/jellyfin — GHSA-c39p-cgf8-866g
What: Potential path transversal exposure in PluginsController.cs
Our version: 10.11.11 (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
Fixed in: 12.0
Severity: low
Source: GitHub advisory
Link: https://github.com/jellyfin/jellyfin/security/advisories/GHSA-c39p-cgf8-866g
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
jellyfin/jellyfin — GHSA-cf3c-8m59-2vhx
What: Memory exhaustion and SSRF via external references in user-supplied SVG images
Our version: 10.11.11 (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
Fixed in: 12.0
Severity: high
Source: GitHub advisory
Link: https://github.com/jellyfin/jellyfin/security/advisories/GHSA-cf3c-8m59-2vhx
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
jellyfin/jellyfin — GHSA-hw73-62vp-9gxf
What: Potential path transversal exposure in HlsSegmentController.cs
Our version: 10.11.11 (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
Fixed in: 12.0
Severity: medium
Source: GitHub advisory
Link: https://github.com/jellyfin/jellyfin/security/advisories/GHSA-hw73-62vp-9gxf
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
louislam/uptime-kuma — GHSA-qjxc-h5jf-c7rj
What: GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accounts in uptime kuma
Our version: 2.5.5 (uptime-kuma; templates/uptime-kuma/.felhom.yml upstream: louislam/uptime-kuma)
Fixed in: the range is unreadable — check by hand
Severity: medium
Source: GitHub advisory — the range could not be read; check by hand
Link: https://github.com/louislam/uptime-kuma/security/advisories/GHSA-qjxc-h5jf-c7rj
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
louislam/uptime-kuma — release:louislam/uptime-kuma@2.5.6
What: ⬆️ Security Fixes
Our version: 2.5.5 (uptime-kuma; templates/uptime-kuma/.felhom.yml upstream: louislam/uptime-kuma)
Fixed in: 2.5.6
Severity: not given
Source: release notes
Link: https://github.com/louislam/uptime-kuma/releases/tag/2.5.6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
louislam/uptime-kuma — release:louislam/uptime-kuma@2.5.7
What: ⬆️ Security Fixes
Our version: 2.5.5 (uptime-kuma; templates/uptime-kuma/.felhom.yml upstream: louislam/uptime-kuma)
Fixed in: 2.5.7
Severity: not given
Source: release notes
Link: https://github.com/louislam/uptime-kuma/releases/tag/2.5.7
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
louislam/uptime-kuma — release:louislam/uptime-kuma@2.5.8
What: ⬆️ Security Fixes
Our version: 2.5.5 (uptime-kuma; templates/uptime-kuma/.felhom.yml upstream: louislam/uptime-kuma)
Fixed in: 2.5.8
Severity: not given
Source: release notes
Link: https://github.com/louislam/uptime-kuma/releases/tag/2.5.8
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
lscr.io/linuxserver/bookstack — release:BookStackApp/BookStack@v26.09.2
What: Security Release
Our version: 26.09.1 (bookstack; templates/bookstack/.felhom.yml upstream: lscr.io/linuxserver/bookstack)
Fixed in: v26.09.2
Severity: not given
Source: release notes
Link: https://github.com/BookStackApp/BookStack/releases/tag/v26.09.2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
lscr.io/linuxserver/code-server — release:coder/code-server@v4.141.1
What: Brotli decoder ( CVE-2026-111497 )
Our version: 4.129.0 (code-server; templates/code-server/.felhom.yml upstream: lscr.io/linuxserver/code-server)
Fixed in: v4.141.1
Severity: not given
Source: release notes
Link: https://github.com/coder/code-server/releases/tag/v4.141.1
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
lukevella/rallly — GHSA-gmq4-f8j5-8w8q
What: Remote code execution in poll preview images via vulnerable Next.js next/og
Our version: 4.15.3 (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
Fixed in: 4.15.4
Severity: critical
Source: GitHub advisory
Link: https://github.com/lukevella/rallly/security/advisories/GHSA-gmq4-f8j5-8w8q
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
lukevella/rallly — release:lukevella/rallly@v4.15.4
What: 🔒 Critical security fix: remote code execution in poll preview images
Our version: 4.15.3 (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
Fixed in: v4.15.4
Severity: not given
Source: release notes
Link: https://github.com/lukevella/rallly/releases/tag/v4.15.4
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
lukevella/rallly — release:lukevella/rallly@v4.15.5
What: 🔒 Security fix: denial of service through Server Actions
Our version: 4.15.3 (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
Fixed in: v4.15.5
Severity: not given
Source: release notes
Link: https://github.com/lukevella/rallly/releases/tag/v4.15.5
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
lukevella/rallly — release:lukevella/rallly@v4.16.0
What: The Control Panel tells you when an update is available and whether it fixes a security issue
Our version: 4.15.3 (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
Fixed in: v4.16.0
Severity: not given
Source: release notes
Link: https://github.com/lukevella/rallly/releases/tag/v4.16.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
lukevella/rallly — release:lukevella/rallly@v4.16.2
What: js security update
Our version: 4.15.3 (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
Fixed in: v4.16.2
Severity: not given
Source: release notes
Link: https://github.com/lukevella/rallly/releases/tag/v4.16.2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
outlinewiki/outline — release:outline/outline@v1.12.0
What: 1 which fixes multiple recently disclosed vulnerabilities
Our version: 1.10.1 (outline; templates/outline/.felhom.yml upstream: outlinewiki/outline)
Fixed in: v1.12.0
Severity: not given
Source: release notes
Link: https://github.com/outline/outline/releases/tag/v1.12.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
privatebin/pdo — release:PrivateBin/PrivateBin@2.1.0
What: More details on this issue can be found in the security advisory:
Our version: 2.0.6 (privatebin; templates/privatebin/.felhom.yml upstream: privatebin/pdo)
Fixed in: 2.1.0
Severity: not given
Source: release notes
Link: https://github.com/PrivateBin/PrivateBin/releases/tag/2.1.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
rommapp/romm — release:rommapp/romm@5.4.0
What: 0 [security] by @renovate [bot] in #4966
Our version: 5.3.1 (romm; templates/romm/.felhom.yml upstream: rommapp/romm)
Fixed in: 5.4.0
Severity: not given
Source: release notes
Link: https://github.com/rommapp/romm/releases/tag/5.4.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
rommapp/romm — release:rommapp/romm@5.4.1
What: While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible
Our version: 5.3.1 (romm; templates/romm/.felhom.yml upstream: rommapp/romm)
Fixed in: 5.4.1
Severity: not given
Source: release notes
Link: https://github.com/rommapp/romm/releases/tag/5.4.1
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
vikunja/vikunja — release:go-vikunja/vikunja@v2.7.0
What: 🔒 Six security fixes
Our version: 2.6.0 (vikunja; templates/vikunja/.felhom.yml upstream: vikunja/vikunja)
Fixed in: v2.7.0
Severity: not given
Source: release notes
Link: https://github.com/go-vikunja/vikunja/releases/tag/v2.7.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
vikunja/vikunja — release:go-vikunja/vikunja@v2.7.1
What: 🔒 A whopping 41(!) security fixes from community reports and an automated audit, reworked attachment previews, signed Docker images and a pile of bugfixes
Our version: 2.6.0 (vikunja; templates/vikunja/.felhom.yml upstream: vikunja/vikunja)
Fixed in: v2.7.1
Severity: not given
Source: release notes
Link: https://github.com/go-vikunja/vikunja/releases/tag/v2.7.1
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
A notice is mailed once, and again every 7 days while it stays open. Night of 2026-10-26.
STATE written: documentation/security-watch/state.json (142 known advisories)
::group::Run set -u
set -u
f=documentation/security-watch/state.json
if [ ! -f "$f" ]; then
echo "no memory file was written - nothing to commit"; exit 0
fi
if git ls-files --error-unmatch "$f" >/dev/null 2>&1 && git diff --quiet -- "$f"; then
echo "memory unchanged - nothing to commit"; exit 0
fi
cp "$f" /tmp/state.json
auth=$(python3 -c 'import base64,os;print(base64.b64encode(("x:"+os.environ["PUSH_TOKEN"]).encode()).decode())')
for attempt in 1 2 3; do
git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
mkdir -p "$(dirname "$f")" && cp /tmp/state.json "$f"
git add "$f"
git -c user.name="felhom security watch" -c user.email=monitoring@felhom.eu \
commit -q -m "security-watch: memory of $(date -u +%F) (R-1303). Docs only." || { echo "nothing to commit"; exit 0; }
if git -c http.extraHeader="Authorization: Basic $auth" push -q origin HEAD:main; then
echo "memory pushed: $(git rev-parse --short=12 HEAD)"; exit 0
fi
echo "push refused (attempt $attempt) - re-fetching main"
sleep 5
done
echo "MEMORY NOT SAVED after 3 attempts"; exit 1
shell: bash --noprofile --norc -e -o pipefail {0}
env:
PUSH_TOKEN: ***
::endgroup::
remote: . Processing 1 references
remote: Processed 1 references in total
memory pushed: ed843da7887a
Cleaning up container for job watch
🏁 Job succeeded
Reference in new issue View Git Blame Copy Permalink