jekkos def0c27a0e fix(security): Path traversal vulnerability in getPicThumb (#4545) ...

Security impact:
- Authenticated attackers could read arbitrary files on the server
- Path traversal via unsanitized pic_filename parameter
- Could read .env, config files, encryption keys

Fix:
- Apply basename() to strip directory components
- Validate file extension to allowlist image types only
- Add explicit error response for invalid file types

CVE: Pending
Affected: <= 3.4.2
Reported by: Kamran Saifullah (VulDB)

Co-authored-by: Ollama <ollama@steganos.dev>

2026-05-15 22:04:29 +02:00

56 KiB

Raw Blame History

View Raw