v1.5.7-stable

gtsteffaniak/filebrowserv1.5.7-stableOct 4, 2026by gtsteffaniak

Upgrading?

AI Summary

Security update fixing a TOTP re-enrollment bypass vulnerability and upgrading Docker ffmpeg.

Key Highlights

  • High severity security fix for TOTP re-enrollment MFA bypass
  • Docker ffmpeg upgraded from 9.0.1 to 9.0.2

Full Release Notes

## What's Changed

> [!WARNING]  
> This release has been superseded by v1.5.8-stable, as it introudces a TOTP login change that prevented login in some circumstances.

 **Security**:
 - [High] TOTP re-enrollment via `POST /api/auth/otp/generate` and `POST /api/auth/otp/verify` no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.

 **Notes**:
 - [docker] upgraded ffmpeg version from 9.0.1 to 9.0.2

## All Changes
* updated dependencies v1.5.7-stable by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3066
* Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3068
* updated docker ffmpeg v1.5.7 by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3069

**Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v1.5.6-stable...v1.5.7-stable

Related Repositories