v1.4.474

danielmiessler/Fabricv1.4.474Sep 3, 2026by github-actions[bot]

AI Summary

A security-focused release that addresses critical vulnerabilities in storage handling, directory traversal, and authentication for Ollama server.

Key Highlights

Reject unsafe cross-platform storage names and directory traversal attempts
Confine symlink targets to configured filesystem storage directories
Require API keys for non-loopback server bindings and authenticate Ollama routes
Validate chat pattern, context, and session names early to prevent filesystem details from leaking

New Features

Default the REST server to loopback port 8080
Add regression coverage for traversal, symlink, and authentication security

Full Release Notes

## Changes

### PR [#2206](https://github.com/danielmiessler/Fabric/pull/2206) by [ksylvan](https://github.com/ksylvan): fix: confine storage names and authenticate Ollama serve

- Reject unsafe cross-platform storage names and directory traversal attempts.
- Confine symlink targets to configured filesystem storage directories.
- Require API keys for non-loopback server bindings and authenticate Ollama routes.
- Validate chat pattern, context, and session names early while preventing internal filesystem details from leaking through client errors.
- Default the REST server to loopback port 8080 and add regression coverage for traversal, symlink, and authentication security.