v2.1.2-beta
gtsteffaniak/filebrowserv2.1.2-betaOct 13, 2026by gtsteffaniak
Upgrading?
AI Summary
This beta release focuses on security hardening against directory traversal and session token collisions. It also introduces usability improvements by removing the quick save setting and enhancing download caching.
Key Highlights
- Fixed a high-severity security vulnerability allowing '..' usernames to escape scoped folders.
- Resolved session token collision issues that occurred when multiple users logged in simultaneously.
- Removed the 'Editor quick save' setting, making the save button always present in the editor toolbar.
- Improved WebDAV support by correctly advertising allowed methods and revalidating downloads.
Breaking Changes
- Removed 'userDefaults.fileViewer.quickSave' setting.
New Features
- Added Basque (eu) translation.
Full Release Notes
## What's Changed **Security**: - [High] New accounts named with ".." breaks out of scoped folder on creation (GHSA-c84q-q5g6-r47f) -- reporter @dylanzonix - [Medium] Fixed session token collision issue when multiple users login simultaneously. (GHSA-c9cr-w724-gqj3) (#3135) Thanks @dl-pt reporters: @Ishtiaque-Ahmed-Risat @AlexWhiplash @tonghuaroot **Notes**: - Removed "Editor quick save" setting (`userDefaults.fileViewer.quickSave`), the save button is now always present in the editor toolbar. (#3122) - add Basque (eu) translation and fix Spanish (es) strings (#3118) **Bug Fixes**: - fix(webdav): OPTIONS now advertises only methods actually supported and permitted for the user; the DAV header reports class 1 only since LOCK/UNLOCK are not enabled (#3110) - fix(download): revalidate single-file downloads so a changed file is not served stale (#3133) - Language switcher not working (#3114) (#3117) - Viewer showing a stale image after the file changed on disk: single-file downloads are now revalidated by the browser (#3132) ## All Changes * fix language switcher in builds by @Kurami32 in https://github.com/gtsteffaniak/filebrowser/pull/3117 * Remove editor quick save by @Kurami32 in https://github.com/gtsteffaniak/filebrowser/pull/3122 * add Basque (eu) translation and fix Spanish (es) strings by @planetryan in https://github.com/gtsteffaniak/filebrowser/pull/3118 * Announce v2.0.0-stable by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3126 * fix(download): revalidate single-file downloads so a changed file is not served stale by @tux86 in https://github.com/gtsteffaniak/filebrowser/pull/3133 * fix: WebDAV OPTIONS by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3123 * fix(auth): prevent collisions between newly issued tokens by @dl-pt in https://github.com/gtsteffaniak/filebrowser/pull/3135 * fix: reject usernames that do not map to their own home directory by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3138 * updated changelog for v2.1.2 by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3140 * Beta/v2.1.2 by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3142 ## New Contributors * @planetryan made their first contribution in https://github.com/gtsteffaniak/filebrowser/pull/3118 * @tux86 made their first contribution in https://github.com/gtsteffaniak/filebrowser/pull/3133 * @dl-pt made their first contribution in https://github.com/gtsteffaniak/filebrowser/pull/3135 **Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v2.1.1-beta...v2.1.2-beta
Related Repositories
ollama/ollama★ 184,218
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
fatedier/frp★ 110,057
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
infiniflow/ragflow★ 92,619
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
gohugoio/hugo★ 90,199
The world’s fastest framework for building websites.
junegunn/fzf★ 83,715
:cherry_blossom: A command-line fuzzy finder