v1.5.7-stable
gtsteffaniak/filebrowserv1.5.7-stableOct 4, 2026by gtsteffaniak
Upgrading?
AI Summary
Security update fixing a TOTP re-enrollment bypass vulnerability and upgrading Docker ffmpeg.
Key Highlights
- High severity security fix for TOTP re-enrollment MFA bypass
- Docker ffmpeg upgraded from 9.0.1 to 9.0.2
Full Release Notes
## What's Changed > [!WARNING] > This release has been superseded by v1.5.8-stable, as it introudces a TOTP login change that prevented login in some circumstances. **Security**: - [High] TOTP re-enrollment via `POST /api/auth/otp/generate` and `POST /api/auth/otp/verify` no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845. **Notes**: - [docker] upgraded ffmpeg version from 9.0.1 to 9.0.2 ## All Changes * updated dependencies v1.5.7-stable by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3066 * Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3068 * updated docker ffmpeg v1.5.7 by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3069 **Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v1.5.6-stable...v1.5.7-stable
Related Repositories
ollama/ollama★ 184,206
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
fatedier/frp★ 110,051
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
infiniflow/ragflow★ 92,612
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
gohugoio/hugo★ 90,198
The world’s fastest framework for building websites.
junegunn/fzf★ 83,716
:cherry_blossom: A command-line fuzzy finder