PLANKA Community 2.2.1 — Security release
This is an emergency release fixing a security vulnerability. We recommend
updating as soon as possible.
Security
-
Fixed a path traversal vulnerability (CWE-22) in the JWT-protected static
file routes (/user-avatars,/background-images,/favicons). On instances
using local file storage, an authenticated user could read arbitrary files
readable by the PLANKA process. Fixed by enforcing that resolved paths stay
within the uploads root. S3-backed storage was not affected.Reported responsibly by Alpastx — thank you.
Details: [GHSA link]
Full Changelog: v2.2.0...v2.2.1