Skip to content

v1.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Aug 22:43
· 40 commits to main since this release
v1.2.1
d9a1125

Librarr v1.2.1

This is a security release. Upgrading is recommended for all installations.

Security

Two vulnerabilities were reported privately by Mahmoud Hassan (@mahmou012d-hunter), who reproduced both end to end and provided detailed reports covering the affected code paths, root cause, impact, and recommended fixes. Thank you.

Path traversal in the manga organizer — GHSA-fm6w-7xh5-xjqw (CVSS 9.1)

The manga organizer built its destination directory from a caller-supplied series title without stripping path separators, so a crafted title could create directories and write files outside the configured library root, anywhere the service user could write. Both the manual-import API and the download watcher (which passes the torrent name through) reached the vulnerable code.

Series titles are now sanitized like every other organizer, and every organized destination is verified to resolve inside its library root — symlinks included — across the ebook, audiobook, manga, and Kavita copy paths.

SSRF via torrent and NZB download URLs — GHSA-c72q-2p2f-7q39 (CVSS 7.2)

The torrent and NZB paths passed a caller-supplied download URL to the configured download client without validation. The client — qBittorrent, Transmission, Deluge, or SABnzbd — then performed the HTTP request from its own network position, allowing requests to internal services and cloud metadata endpoints.

Outbound URL validation now runs at the shared entry point used by every caller, matching the guard already present on direct downloads. Magnet links and the operator-configured Prowlarr origin are unaffected, so LAN indexer setups keep working.

Other changes

  • Added SECURITY.md documenting the private reporting channel, what reporters can expect, how credit is given, and Librarr's deployment assumptions.
  • Enabled private vulnerability reporting on the repository — please report security issues through GitHub's private reporting rather than a public issue.

Upgrade notes

No configuration changes are required. If you download torrents from a LAN mirror that is not your configured Prowlarr instance, that URL will now be rejected unless you set LIBRARR_INSECURE_ALLOW_PRIVATE_URLS=1.

Assets 10
Loading