This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+6 more
Affected surfaces
ReleasePort's take
Moderate signalA critical path traversal vulnerability enables arbitrary file downloads outside the intended temporary extraction directory.
Why it matters: Severity score of 95 indicates a high‑risk flaw; operators must patch immediately to prevent unauthorized data exfiltration via the file download endpoint.
Summary
AI summaryBroad release touches ui, backup-plans, deps, and fix.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Security: Path traversal allows arbitrary file download outside temporary extraction directory Security: Path traversal allows arbitrary file download outside temporary extraction directory Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Adds managed CLI agent support Adds managed CLI agent support Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Adds SQLite database source parity Adds SQLite database source parity Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Adds btrfs and zfs snapshot sources Adds btrfs and zfs snapshot sources Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Implements remote‑direct backup execution Implements remote‑direct backup execution Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Implements managed‑agent repository execution orchestration Implements managed‑agent repository execution orchestration Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Low |
Adds optional cloud mirror for repositories Adds optional cloud mirror for repositories Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Implements rclone‑backed repository storage Implements rclone‑backed repository storage Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Supports direct Borg 2 rclone repositories Supports direct Borg 2 rclone repositories Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Adds guided cloud storage source setup Adds guided cloud storage source setup Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Schedules repository cloud mirror syncs Schedules repository cloud mirror syncs Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Supports server‑owned cloud mirrors for SSH repositories Supports server‑owned cloud mirrors for SSH repositories Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Reuses archive browser for cloud storage browsing Reuses archive browser for cloud storage browsing Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Displays agent names in path browser Displays agent names in path browser Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Adds managed‑agent cloud mirror ownership Adds managed‑agent cloud mirror ownership Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Implements secure repository contents wipe flow Implements secure repository contents wipe flow Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Adds backup monitoring alerts and reports Adds backup monitoring alerts and reports Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Dependency | Low |
Bumps actions/setup-node from version 4 to 6 Bumps actions/setup-node from version 4 to 6 Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Bugfix | Medium |
Fixes Hetzner SFTP child folder browsing issue Fixes Hetzner SFTP child folder browsing issue Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Bugfix | Medium |
Fixes agent filesystem browse timeouts Fixes agent filesystem browse timeouts Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Bugfix | Medium |
Fixes managed agent Borg 2 installation problems Fixes managed agent Borg 2 installation problems Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Bugfix | Low |
Fixes Unicode escapes in JSON logs Fixes Unicode escapes in JSON logs Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
Full changelog
What's Changed
- fix(ui): polish cloud OAuth and plan content (391f568c)
- ci(deps): bump actions/setup-node from 4 to 6 (#595) (4f9d708f)
- ci(deps): bump actions/upload-pages-artifact from 3 to 5 (#596) (f27cfe58)
- ci(deps): bump actions/configure-pages from 5 to 6 (#597) (606a4f24)
- Add saved script hook chains to backup plans (d14380cf)
- fix(backup-plans): harden database source scripting (9347312e)
- Simplify database template detail (#588) (fc5b24ff)
- fix(ui): rclone OAuth polish + center empty-state icons (#591) (bd155419)
- Show auto-filled script values in backup plan wizard (#587) (72a622b1)
- Always run visual reports, clean closed PRs, and filter noise (8f513ec5)
- Publish visual regression reports on GitHub Pages (03ee9ec0)
- Require paired rclone OAuth app credentials (e3fe42d3)
- Fix SQLite scan detection paths (#584) (740b4d00)
- Move Storybook visual snapshots to Argos CI (#583) (4f7a87a9)
- feat(ui): add target picker to backup plan database tab (6f07737c)
- fix(ui): shrink database scan dialog to 80vh (331fb68f)
- fix(ui): pack repo health cards densely instead of stretching peers (752bfc0f)
- fix(ui): remove unused snapshot import (201c47f3)
- feat(ui): expand responsive snapshot coverage (d3a1e65b)
- Fix backup plan wizard typing latency (17e707dd)
- Fix package reinstall crash and install toast interpolation (04026a9f)
- fix(database): fall back to python for SQLite dumps (60f306de)
- fix(backup-plans): show real database source paths (134224f1)
- Instrument recent feature flows with Umami analytics (694c82b2)
- Gate paid backup source workflows (73eea336)
- fix(frontend): clean database source lint warnings (ba4cbacb)
- Quiet exhaustive-deps lint in scan dialog and source selector (a2eed69c)
- test(storybook): refresh database scan snapshots (9ab248dc)
- feat(backup-plans): preserve database source scripts (4f67e859)
- Refine Script Library table and fix usage count (2462512e)
- Save cloud mirror settings before background sync (5aa217ad)
- Link repositories to filtered backup plans (70ea36e1)
- Fix dashboard mobile overflow and tidy top bar / activity header (afe4c13d)
- Rework active backup run card and surface running plans at top of Plans tab (a185a647)
- feat(ui): add shared backup plan select (c73bfa52)
- Render managed agents without beta gating (bfcec3f3)
- feat(ui): reuse shared browser for rclone paths (aac44caf)
- Use shared log viewer for managed agents (1683dd22)
- feat(ui): add shared rclone remote select (796b97ac)
- Sort repository health with bucket-aware secondary key (19a19d06)
- Fix theme card layout so icon anchors title, not description (70840a91)
- fix: delete restore check jobs with repository (d663b628)
- fix: remove remote machines stats bar (72e80fb0)
- Reorganize sidebar IA: INFRASTRUCTURE + STORAGE groups, Users under Management (66f9ec9e)
- fix(repositories): preserve storage mode on edit (db8e23a4)
- fix: infer ssh key for legacy remote repos (9bb6dd4b)
- Polish dashboard: brand color, lane chart, variable density, failure strip (90ffd7a1)
- Lay out dimension footer as 2x2 grid so labels fit (a51c69d1)
- Enable Borg 2 rclone storage selection and browsing (f3ec46b6)
- Fix managed agent archive downloads (d8ada6bb)
- Improve managed agent refresh status (fec060b8)
- Add managed agent default browse paths (671b15f5)
- Fix agent installer service user config ownership (e8625978)
- fix(backup-plans): reuse shared source chooser controls (1385b316)
- chore: hide back button for db scanning (7659254a)
- docs(ui): document shared component folder contract (d07ba958)
- refactor(ui): move wizard shell into shared components (95514e15)
- refactor(ui): move product primitives into shared components (c3c558ec)
- refactor(ui): move CodeEditor into shared components (04de1d78)
- refactor(ui): move schedule controls into shared components (6f3dae0e)
- refactor(ui): move connection selects into shared components (f3598ef0)
- refactor(ui): move DestinationSelect into shared components (9fa54f30)
- refactor(ui): move RichSelectRow into shared components (1c780505)
- refactor(ui): move ResponsiveDialog into shared components (2e555089)
- docs(ui): plan shared component folder migration (c483ebea)
- refactor(ui): add reusable DestinationSelect (03e9b849)
- Redesign rclone remote dialog with progressive disclosure (f66ebe47)
- Capture final dashboard critique snapshot (57e50e7d)
- Make repo health grid auto-fit and i18n the plan chip (4b2a2664)
- Quieten WizardDialog surface and tokenize EntityCard accents (353361c1)
- Distill dashboard donuts, prune dead tokens left by quieter pass (0dda064b)
- Capture post-quieter critique snapshot for DashboardV3 (2a674f07)
- Quieten DashboardV3: strip glass, glow, and pulse layers (818f956f)
- Extract shared SSH/agent selectors and pivot source picker (2343d2fe)
- Fix WCAG AA contrast at the design token layer (0d056f1e)
- Add PRODUCT.md, DESIGN.md, and impeccable project context (769f3862)
- Prevent conflicting Borg check flag durations (0d35c96e)
- Fix cached rclone repository edit payloads (479bac0d)
- Also disable Borg UI server source card for agent repositories (4cc7782e)
- Disable invalid backup sources for agent repositories (452d0e8d)
- Preserve existing service user during agent reinstall (79c8984c)
- Streamline Add Agent wizard and add service user installer option (3d318e35)
- Redesign repository wizard destination picker (f084508e)
- Document shared UI components in AGENTS.md (1b1970a9)
- Dispatch agent repo init with configurable timeout (8e60691e)
- fix(agent): dispatch backups and browse archives via agent (f075bce4)
- Allow remote repo location with managed agent execution (98199aa5)
- Add managed agent reinstall action (90773f25)
- Polish cloud storage OAuth setup UX (f3ae14ec)
- Persist Borg cache volume in Docker (776ce702)
- Add automated Borg UI configuration export (ea205f83)
- Initialize agent repositories before create success (0dfaac50)
- Move agent dispatch to live WebSocket sessions (607beb9f)
- Clarify BorgBase setup documentation (7bfff407)
- Improve plan drawer contrast accessibility (252df86b)
- Support direct Borg 2 rclone repositories (57fbe108)
- chore(symphony): lower agent concurrency (42b107b9)
- Support Borg UI-owned OAuth callbacks (248c3558)
- Document direct rclone mount support decision (758034a8)
- Schedule repository cloud mirror syncs (4fd13974)
- Add guided cloud storage source setup (ba62456e)
- Add managed-agent cloud mirror ownership (3345d5e9)
- Support server-owned cloud mirrors for SSH repositories (fb8c1405)
- Reuse archive browser for cloud storage browsing (4b1a56d9)
- Display agent names in path browser (6c57af0e)
- Remove duplicate repository break-lock route (ea818729)
- Document hosted and NAS onboarding paths (7d629332)
- Document app navigation workflow (920ff3fb)
- Refresh Borg UI Postman collection (933f701f)
- Add optional cloud mirror for repositories (325c0a09)
- Remove legacy Borg UI logo assets (24cf11c1)
- Document BorgBase onboarding paths (2579c936)
- Split sidebar Backup section into Hosts, Targets, and Backups (8f1094b1)
- Share PageHeader and ListToolbar across list pages (375aaf84)
- Add Symphony Linear ticket metadata bootstrap (3bd2944e)
- Document archive browsing limits (3dace5ec)
- Implement rclone-backed repository storage (99fd597f)
- Plan rclone storage integration (d9c92ea3)
- Fix agent filesystem browse timeouts (553beab5)
- Implement remote-direct backup execution (70f0406b)
- Add btrfs and zfs snapshot sources (314f575d)
- Add SQLite database source parity (4ee8e324)
- Fix Unicode escapes in JSON logs (f9c30b89)
- Allow Linear Merging to bypass review-required PRs (675b6b22)
- Add Code Review Reply workflow mode (6ac7b64f)
- Fix managed agent Borg 2 installation (eae40fe0)
- docs(plans): plan remote direct backup execution (#526) (4bf69f8d)
- Stabilize layout shifts in backup wizards (84560f9d)
- docs: document rootless Podman permissions (#527) (d25dd495)
- Install Borg from managed agent setup (#524) (acbf1b4a)
- Fix managed agent browsing cache and Linux copy (#525) (12fb2637)
- Move backup cache guidance to troubleshooting (#523) (3a820182)
- docs: explain slow backup cache behavior (e45b0ef0)
- Use cron timezone scheduling for backup reports (#521) (3bf3e382)
- Add managed agent onboarding and path browsing (8d68b887)
- Document Docker socket proxy hook access (a9e65228)
- Preserve Borg slash-dot SSH repository paths (#518) (24a26fbe)
- Track no-fix pip-audit findings (#516) (fac235db)
- Validate borg-ui-agent systemd service identity (#517) (98ac00ef)
- Support agent-owned backup plan routing (a8bcedda)
- Add backup monitoring alerts and reports (92b9c6be)
- Move agent source capture to backup plans (#513) (aaf7d184)
- Implement managed-agent repository execution orchestration (dd68431e)
- docs: plan managed agent orchestration (#510) (7660f0d7)
- feat(backup-plans): brand SVG icons + 4-col template grid + dropdown alignment (1ef33a29)
- feat(backup-plans): single-row source group + horizontal db template tiles + fixed modal height (fce5d14c)
- feat(backup-plans): polish source picker — backgrounds, skeletons, wider modal (c7cd0cd8)
- fix(backup-plans): tidy SSH option formatting + surface scanned paths (6aef9969)
- Implement source-aware database scan backend (#509) (81257a31)
- test(backup-plans): regenerate source picker snapshots (b4159e1a)
- test(backup-plans): add stories for redesigned source picker (516433b0)
- feat(backup-plans): redesign source picker around scan-configurable databases (d326c928)
- test(managed-agents): regenerate fleet overview snapshot (d15a730f)
- refactor(managed-agents): align with shared design language and drop placeholder backup dialog (cdf0fd18)
- fix(managed-agents): clarify client setup flow (#506) (3aa4ee95)
- fix(storybook): keep unchanged snapshot files stable (#505) (79432bc3)
- Implement secure repository contents wipe flow (#502) (497f3826)
- Revert "Implement selector-driven Symphony validation" (#504) (c090ef2b)
- Revert "Allow Linear Merging to bypass review-required PRs" (#503) (b7f1b767)
- Allow Linear Merging to bypass review-required PRs (03ce19c1)
- Implement selector-driven Symphony validation (#496) (17459a09)
- Design secure repository contents wipe flow (#497) (bd762553)
- Document Synology SSH path prefixes (#498) (89660050)
- Add managed CLI agent support (#493) (4fd94823)
- Allow advanced Borg check flags (e0cd0948)
- Run manual prune as a background job (#494) (6cf28b40)
- Allow grouped backup source locations (#490) (5d398951)
- Document Symphony issue-to-PR latency reductions (f8b8f5e7)
- Update usage guide for Backup Plans (56b092c1)
- Normalize SSH connection host input (#487) (801c8cf0)
- feat(ui): add copy-to-clipboard buttons for command previews (41241dd7)
- Fix Hetzner SFTP child folder browsing (3967b0b7)
- Add database source discovery flow (7d5e20a8)
- feat(land): add fast landing preflight (#483) (e99bef0c)
- Classify SSH deployment DNS failures (2ed3586d)
- fix(ssh): classify DNS connection-test failures (#484) (04c3122c)
- Add Storybook snapshots (#480) (4e965ca5)
- Fix multi-repository plan content label (e1a16fa3)
- Fix profile menu contrast (2bc1dcff)
- Security: Path traversal allows arbitrary file download outside temporary extraction directory (6712dc69)
Docker Images
Published to Docker Hub:
docker pull ainullcode/borg-ui:2.2.0
docker pull ainullcode/borg-ui:latest
Full Changelog: https://github.com/karanhudia/borg-ui/compare/v2.1.0...v2.2.0
Security Fixes
- Security: Path traversal allows arbitrary file download outside temporary extraction directory (CVE not listed) — fixed.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About borg-ui
Replace complex Borg Backup terminal commands with a beautiful web UI. Create, schedule, and restore backups with just a few clicks.
Related context
Beta — feedback welcome: [email protected]