v1.8.3

gitroomhq/postiz-appv1.8.3Apr 7, 2026by lfnovo

AI Summary

This release addresses a critical security vulnerability (CVSS 8.7) involving SurrealDB injection in the notebooks API. The update implements parameterized queries and allowlist validation to mitigate CSRF and SQL injection risks.

Key Highlights

Critical security fix for SurrealDB injection via unsanitized `order_by` parameter (CVSS 8.7 High)
Added allowlist validation for sorting parameters in the `/api/notebooks` endpoint
Replaced unsafe f-string interpolation with parameterized `$variable` binding
Implemented defensive validation in the base `get_all()` method
Reported and credited to CERT-EU Offensive Security Team

Full Release Notes

## Security

- **Fix SurrealDB injection via unsanitized `order_by` query parameter** (CVSS 8.7 High)
  - `GET /api/notebooks` accepted arbitrary input in the `order_by` parameter, allowing injection of SurrealQL commands. Exploitable via CSRF by tricking a user into clicking a crafted URL.
  - Added allowlist validation for sorting parameters in the notebooks endpoint
  - Replaced f-string query interpolation with parameterized `$variable` binding in source chat and migration queries
  - Added defensive validation in the `get_all()` base method to prevent injection via `order_by` parameter

### Affected versions

All versions up to and including v1.8.2.

### Recommended action

Upgrade to v1.8.3 immediately.

### Credit

Reported by [CERT-EU](https://cert.europa.eu) Offensive Security Team via coordinated vulnerability disclosure.