v3.0.1

A modern, lightning-fast file sharing platform built for self-hosting

🔒 Security Fixes

Flare 3.0.1 is a security release, so please update as soon as you can.

birb (@parabirb) audited Flare 3.0 and sent me a detailed report with sixteen findings. I checked every one against 3.0.0 and fixed each one that held up, plus a few bugs that turned up while I was in there. Six of them get an advisory:

Severity	What could happen	Who's affected	Advisory
High	An upload with a crafted name made a data export write files anywhere the app could, including over its own code	S3 storage	GHSA-g39q-crp4-2ch6
High	An uploaded SVG's thumbnail URL could run script on your Flare origin with the visitor's session	Instances where people you don't fully trust can upload	GHSA-4fr7-p4rm-r2f6
High	Classic appearance colors and the theme mode could put script on every page, including sign-in	Instances that gave appearance.manage to someone who isn't an admin	GHSA-jf87-vxjh-6gv2
High	File passwords could be guessed with no limit, and a one-character password was allowed	Password-protected files	GHSA-qxr9-m5ff-27rv
High	Anyone could start unlimited OCR runs on a public image without saved text, and a failed run repeated on every request	Any instance with public images	GHSA-7p5v-2m9m-3p9m
Medium	Private and password-protected videos were sent as publicly cacheable for a year	Instances behind a CDN or caching proxy	GHSA-5gjg-xfq3-pp83

There's also some hardening: every rate limit now reads the client address the same way (with a new FLARE_CLIENT_IP_HEADER for edges like Cloudflare), pages send Cross-Origin-Opener-Policy: same-origin, the workflows pin every action to a commit, and you can now cap audit history with FLARE_AUDIT_RETENTION_DAYS.

🐛 Fixes

• Big uploads from API clients: Next.js was cutting every API request body off at 10 MB, so direct uploads over 10 MB from ShareX, scripts, and other clients failed. They now work up to your configured limits.
• Upload limits always hold: an upload that ran into the size limit or your remaining quota early could be saved cut short and reported as a success. It's now refused with 413 and nothing is kept.
• Names in other languages: files up to 10 MB uploaded from the browser or with curl came out garbled when their names had accents or non-Latin scripts, like café.png. New uploads keep their names. Files uploaded earlier keep the garbled name, but their links and contents are fine.
• Rejected uploads answer right away instead of hanging until the client gave up.
• Cleaner URL names: collision names and extensions are sanitized like everything else, and signed-out visitors can open public links whose names have no extension.
• Data exports: Export All Data now builds the ZIP while it downloads, keeps files that share a name as separate entries, stops when you leave the page, and no longer hangs on S3.
• Byte ranges: malformed or out-of-range requests get a proper 416 instead of an error, and suffix ranges return the right bytes on S3.
• The classic color picker works: it used to save hex values the theme couldn't read, which could leave a primary button transparent. Colors you picked earlier now show up as picked.
• Less overhead per request: view, download, and click counters no longer write a second audit event, and settings are parsed once per change instead of on every read.

❤️ Thanks

Big thanks to @parabirb for running this audit thru DeepSeek. It came with working reproductions for the serious issues and a score for every finding, which made checking and fixing all of this a lot faster.

I'm also working on getting access to frontier LLM secure access programs so I can keep auditing Flare and make it as secure as possible at the frontier. If you find something, the security policy explains how to report it privately.

⬆️ Updating

Back up your database and uploads, then update the image as usual. There are no database migrations, and nobody is signed out unless you change NEXTAUTH_SECRET.

Upgrade guide: 3.0 → 3.0.1 · Full changelog: v3.0.0 → v3.0.1

📦 Download & Deploy

AMD64 and ARM64 images:

# Docker Hub
docker pull docker.io/flintsh/flare:3.0.1

# GitHub Container Registry
docker pull ghcr.io/flintsh/flare:3.0.1