posterizarr

v3.0.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 12d Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

arr imagemagick posters

Affected surfaces

auth rce_ssrf

Summary

AI summary

Updates Fixes & Improvements, What's New, and Feature across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds "Auto-Fetch Token" button for Plex login in Config Editor and Onboarding Modal. Adds "Auto-Fetch Token" button for Plex login in Config Editor and Onboarding Modal. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Medium	Registers Posterizarr in Plex "Authorized Devices" list with version, OS, and device name. Registers Posterizarr in Plex "Authorized Devices" list with version, OS, and device name. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Medium	Builds Plex OAuth flow directly into frontend for secure, lightweight authentication. Builds Plex OAuth flow directly into frontend for secure, lightweight authentication. Source: llm_adapter@2026-07-14 Confidence: low	—
Feature	Low	Clarifies which API keys (TMDB, TVDB, Fanart) have free tiers in onboarding UI and docs. Clarifies which API keys (TMDB, TVDB, Fanart) have free tiers in onboarding UI and docs. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes directory traversal issues and improves overlay file handling. Fixes directory traversal issues and improves overlay file handling. Source: llm_adapter@2026-07-14 Confidence: low	—
Bugfix	Low	Improves validation checks and execution order for online provider API keys. Improves validation checks and execution order for online provider API keys. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Low	Fixes minor rendering issue with the Plex logo in the UI. Fixes minor rendering issue with the Plex logo in the UI. Source: llm_adapter@2026-07-14 Confidence: high	—

Full changelog

What's New

Auto-Fetch Plex Token: Added a new "Auto-Fetch Token" button to the Config Editor and Onboarding Modal. You can now log into Plex directly to grab your token instead of hunting for it in your browser's network tab or XML files.
Better Plex Device Registration: When you use the Auto-Fetch button, Posterizarr will now properly register itself in your Plex "Authorized Devices" list with its actual version, OS, and device name (similar to how Tautulli does it).
API Key Clarity: Updated the onboarding UI and docs to clearly show which API keys (TMDB, TVDB, Fanart) have free tiers to make the initial setup less confusing.

Fixes & Improvements

Fixed directory traversal issues and improved how overlay files are handled and selected.
Improved validation checks and the execution order for online provider API keys.
Fixed a minor rendering issue with the Plex logo in the UI.
Built the Plex OAuth flow directly into the frontend to keep it secure and lightweight, without adding extra backend dependencies.

What's Changed

Sync Main Manifest.json to dev by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/611
Feature: Seamless Plex OAuth Integration and UI Improvements by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/612

Full Changelog: https://github.com/fscorrupt/posterizarr/compare/3.0.1...3.0.2

Security Fixes

Fixed directory traversal vulnerabilities and improved overlay file handling

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track posterizarr

Get notified when new releases ship.

About posterizarr

Automated poster maker for Plex/Jellyfin/Emby.

All releases →