Skip to content

Release v2026.08.16.27

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Aug 11:53
· 4 commits to main since this release
v2026.08.16.27
31f1f39
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

RustRconServerManager v2026.08.16.27

Download Native Release

Both native releases below are fully standalone: they bundle their own
MariaDB database (listening only on 127.0.0.1:3307, isolated from any other
MariaDB/MySQL you may already have running) so no separate database server
or Docker is required. No .NET runtime required either - both are
self-contained.

Linux (x64)

  • RustRconServerManager-Linux-x64-v2026.08.16.27.tar.gz
  • Extract, then run ./start.sh

Windows (x64)

  • RustRconServerManager-Windows-x64-v2026.08.16.27.zip
  • Extract, then double-click start.bat

The first run generates random database/JWT/RCON credentials and initializes
the bundled database - see the included README.md for details, including how
to point it at your own database server instead if you'd rather do that.

Docker

Alternatively, use Docker:

docker pull ghcr.io/Xenne93/RustRconServerManager:v2026.08.16.27

Or with docker compose (set IMAGE_TAG in your .env, or inline):

IMAGE_TAG=v2026.08.16.27 docker compose up -d

Changes

This release is a security and code-quality hardening pass, prompted by a
full sweep of GitHub Code Scanning findings (104 alerts, all resolved).

Security fixes:

  • Closed an unauthenticated path-traversal issue in the public server-image
    endpoint: a crafted request could previously reach the disk with an
    unvalidated hash parameter before any ownership check ran. Path resolution
    is now validated to stay within the intended storage directory.
  • Fixed a missing authorization check that let any authenticated user
    (including moderators) purge all logged data, including the audit log.
  • Hardened Discord webhook URL validation so it checks the actual host and
    path instead of a substring match, closing a spoofing gap.
  • Cleaned up a fragile error path in server deletion that relied on an
    exception being silently swallowed instead of an explicit not-found check.

Logging hardening:

  • Every log statement that included user-controllable text (names, IDs,
    commands, URLs) now strips control characters first, so a crafted value
    can no longer forge fake log entries.
  • User email addresses are no longer written to application logs; log
    entries now reference the acting user by ID instead.

CI:

  • Both GitHub Actions workflows now declare explicit least-privilege
    permissions instead of relying on defaults.

No functional/UI changes in this release - all fixes are internal
hardening with no expected impact on existing behavior.

Assets 4
Loading