Skip to content

3.7.15

Choose a tag to compare

View all tags
@Zeecka Zeecka released this 09 Nov 06:56
· 43 commits to main since this release
3.7.15
4ac7f26

🔒 Security fix

JPSeek command injection via upload filename — GHSA-m5f8-qc9j-mc55 (critical)

  • A crafted upload filename could break out of the Tcl quoting in the JPSeek analyzer's expect script and run arbitrary commands in the worker container, without authentication. Affects 3.2.1 – 3.7.14.
  • The JPSeek analyzer now passes the image path, output path and password only through environment variables, so nothing user-controlled is interpolated into the script. Original filenames are still kept as uploaded.
  • Added a regression test.

Thanks to @NotAFlightRisk for the report.

Upgrade is strongly recommended for all self-hosted instances.

Full changelog: 3.7.14...3.7.15

Contributors

NotAFlightRisk
Assets 2
Loading