v1.4.462

danielmiessler/Fabricv1.4.462Jul 28, 2026by github-actions[bot]

AI Summary

A critical security vulnerability allowing path traversal attacks in pattern name lookups has been patched, preventing users from accessing arbitrary files via directory traversal sequences.

Key Highlights

Blocked path traversal attacks in pattern name lookup
Added i18n key for invalid pattern names across 11 locale files
Added test cases covering common traversal variants

Full Release Notes

## Changes

### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [ksylvan](https://github.com/ksylvan) and [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup

- **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants.
- New translations for the "invalid pattern" user-facing string.