Patch: SSH Command Injection, Cross-tenant IDOR, and CSRF fixes

Vulnerability Overview SSH Command Injection: Fixed SSH command injection vulnerability (#8748). SSH Session Errors: Resolved 419 session errors related to Cloudflare tunnels and domain-based access (#8749, fixing #5404). SSH Directory Permissions: Fixed SSH directory permission issues during upgrades (#8635, resolving #8621). Automatic SSH Directory Permission Repair: Added automatic repair for SSH directory permissions for new installations (#8635). Command Injection Protection: Prevented command injection via base64 encoding (#8617). Docker Command Execution Hardening: Enhanced Docker command execution to prevent centralized escaping (#8615). Health Check Command Injection: Prevented command injection in health check commands (#8611). IDOR Vulnerability: Fixed cross-tenant IDOR vulnerability in resource cloning (#8613). IPv6 CIDR Support: Added IPv6 CIDR support to the API access IP whitelist (#8750, fixing #8729). Docker 25+ Proxy Initialization: Fixed proxy initialization for IPv6 networks on Docker 25+ (#8703, fixing #8649). CSRF Redirect Loop: Fixed CSRF redirect loop during 2FA authentication (#8596). API Permission Requirements: Corrected API permission requirements for POST endpoints (#8600). Team Authorization Checks: Added team authorization checks to the API (#8616). Cloudreve Service Data Persistence: Fixed data persistence issues for Cloudreve service data on restart (#8745). Ente Photo App Link Configuration: Fixed Ente Photo app link configuration (#8727). App Rollback SHA: Fixed app rollback to use the correct commit SHA (#8575). Deployment Detection: Fixed deployment detection for BuildKit and secrets (#8565). Team Lookup: Resolved team lookup issues in service relationships (#8559, fixing #8431). Webhook Notification Status Validation: Added validation for webhook notification status (#8557, fixing #8448). Deployment Key Handling: Fixed deployment key handling when is 0 (#8563, fixing #8562). Redis/KeyDB Configuration Permissions: Fixed Redis/KeyDB configuration permissions with custom configurations (#8561, fixing #8539). Password Field UI Refresh: Fixed password field UI refresh before Alpine.js initialization (#8599, closing #8592). GlitchTip Dashboard Loading Issues: Fixed GlitchTip dashboard loading issues (#8249). Grist Service Template Configuration: Fixed Grist service template configuration (#8384). API Documentation Schema References: Fixed API documentation schema references (#8239, closing #8229). Impact Scope SSH-Related Vulnerabilities: Affects all systems utilizing SSH commands and sessions. Docker-Related Vulnerabilities: Affects all systems utilizing Docker command execution and proxy initialization. API-Related Vulnerabilities: Affects all systems utilizing API access and permission management. Other Vulnerabilities: Affects all systems utilizing health checks, resource cloning, IDOR, CSRF, webhook notifications, deployment keys, Redis/KeyDB configurations, password fields, GlitchTip dashboards, Grist service templates, and API documentation. Remediation SSH Command Injection: Fixed SSH command injection vulnerability (#8748). SSH Session Errors: Resolved 419 session errors related to Cloudflare tunnels and domain-based access (#8749, fixing #5404). SSH Directory Permissions: Fixed SSH directory permission issues during upgrades (#8635, resolving #8621). Automatic SSH Directory Permission Repair: Added automatic repair for SSH directory permissions for new installations (#8635). Command Injection Protection: Prevented command injection via base64 encoding (#8617). Docker Command Execution Hardening: Enhanced Docker command execution to prevent centralized escaping (#8615). Health Check Command Injection: Prevented command injection in health check commands (#8611). IDOR Vulnerability: Fixed cross-tenant IDOR vulnerability in resource cloning (#8613). IPv6 CIDR Support: Added IPv6 CIDR support to the API access IP whitelist (#8750, fixing #8729). Docker 25+ Proxy Initialization: Fixed proxy initialization for IPv6 networks on Docker 25+ (#8703, fixing #8649). CSRF Redirect Loop: Fixed CSRF redirect loop during 2FA authentication (#8596). API Permission Requirements: Corrected API permission requirements for POST endpoints (#8600). Team Authorization Checks: Added team authorization checks to the API (#8616). Cloudreve Service Data Persistence: Fixed data persistence issues for Cloudreve service data on restart (#8745). Ente Photo App Link Configuration: Fixed Ente Photo app link configuration (#8727). App Rollback SHA: Fixed app rollback to use the correct commit SHA (#8575). Deployment Detection: Fixed deployment detection for BuildKit and secrets (#8565). Team Lookup: Resolved team lookup issues in service relationships (#8559, fixing #8431). Webhook Notification Status Validation: Added validation for webhook notification status (#8557, fixing #8448). Deployment Key Handling: Fixed deployment key handling when is 0 (#8563, fixing #8562). Redis/KeyDB Configuration Perm

Goal Reached Thanks to every supporter — we hit 100%!

Patch: SSH Command Injection, Cross-tenant IDOR, and CSRF fixes

More from this source