Skip to content

v2.2.1-ls77

Choose a tag to compare

View all tags
@LinuxServer-CI LinuxServer-CI released this 01 Oct 20:35
· 10 commits to main since this release
v2.2.1-ls77
78e90d1
This commit was signed with the committer’s verified signature.
LinuxServer-CI LinuxServer.io CI
SSH Key Fingerprint: fh11rWL5oCDRdg8ER4TS1r8mdK7lLmwPcJouqXZgNko
Verified
Learn about vigilant mode.

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v2.2.1-ls76...v2.2.1-ls77

Remote Changes:

PLANKA Community 2.2.1 — Security release

This is an emergency release fixing a security vulnerability. We recommend
updating as soon as possible.

Security

  • Fixed a path traversal vulnerability (CWE-22) in the JWT-protected static
    file routes (/user-avatars, /background-images, /favicons). On instances
    using local file storage, an authenticated user could read arbitrary files
    readable by the PLANKA process. Fixed by enforcing that resolved paths stay
    within the uploads root. S3-backed storage was not affected.

    Reported responsibly by Alpastx — thank you.

    Details: [GHSA link]

Full Changelog: plankanban/planka@v2.2.0...v2.2.1

Assets 2
Loading