Note Mark
  • Support The Project

    • Security Disclosures - 2026-05

    Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution

    If an attacker uploads an asset with a asset name that contains a directory traversal it is possible to write to other locations, if running as root could also allow writing to /bin/bash with a malicious payload.

    The resulting asset will only get placed when an export is performed by an admin. It also requires that an attacker has access to a account.

    Fixed by ensuring export features sanitise asset names and prevent any new asset names from having path separators.

    JWT Secret Weakness allows Full Account Takeover via token forgery

    If an admin sets a JWT_SECRET that is less than 32 bytes long an attacker can brute-force a token to any account if a username/user-id is known.

    This will not effect admins who have set a longer JWT_SECRET.

    Fixed by preventing startup when the secret is too short.