Skip to content

borg-ui

v2.2.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1d Backup & Recovery
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

automation back borg borg-backup borgbackup borgbase
+6 more
deduplication docker raspber sbc self-hosted web

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 1d

A critical path traversal vulnerability enables arbitrary file downloads outside the intended temporary extraction directory.

Why it matters: Severity score of 95 indicates a high‑risk flaw; operators must patch immediately to prevent unauthorized data exfiltration via the file download endpoint.

Summary

AI summary

Broad release touches ui, backup-plans, deps, and fix.

Changes in this release

Security Critical

Security: Path traversal allows arbitrary file download outside temporary extraction directory

Security: Path traversal allows arbitrary file download outside temporary extraction directory

Source: llm_adapter@2026-06-02

Confidence: high

Feature Medium

Adds managed CLI agent support

Adds managed CLI agent support

Source: llm_adapter@2026-06-02

Confidence: high

Feature Medium

Adds SQLite database source parity

Adds SQLite database source parity

Source: llm_adapter@2026-06-02

Confidence: high

Feature Medium

Adds btrfs and zfs snapshot sources

Adds btrfs and zfs snapshot sources

Source: llm_adapter@2026-06-02

Confidence: high

Feature Medium

Implements remote‑direct backup execution

Implements remote‑direct backup execution

Source: llm_adapter@2026-06-02

Confidence: high

Feature Medium

Implements managed‑agent repository execution orchestration

Implements managed‑agent repository execution orchestration

Source: llm_adapter@2026-06-02

Confidence: high

Feature Low

Adds optional cloud mirror for repositories

Adds optional cloud mirror for repositories

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Implements rclone‑backed repository storage

Implements rclone‑backed repository storage

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Supports direct Borg 2 rclone repositories

Supports direct Borg 2 rclone repositories

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Adds guided cloud storage source setup

Adds guided cloud storage source setup

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Schedules repository cloud mirror syncs

Schedules repository cloud mirror syncs

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Supports server‑owned cloud mirrors for SSH repositories

Supports server‑owned cloud mirrors for SSH repositories

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Reuses archive browser for cloud storage browsing

Reuses archive browser for cloud storage browsing

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Displays agent names in path browser

Displays agent names in path browser

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Adds managed‑agent cloud mirror ownership

Adds managed‑agent cloud mirror ownership

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Implements secure repository contents wipe flow

Implements secure repository contents wipe flow

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Feature Low

Adds backup monitoring alerts and reports

Adds backup monitoring alerts and reports

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Dependency Low

Bumps actions/setup-node from version 4 to 6

Bumps actions/setup-node from version 4 to 6

Source: llm_adapter@2026-06-02

Confidence: high

Bugfix Medium

Fixes Hetzner SFTP child folder browsing issue

Fixes Hetzner SFTP child folder browsing issue

Source: llm_adapter@2026-06-02

Confidence: high

Bugfix Medium

Fixes agent filesystem browse timeouts

Fixes agent filesystem browse timeouts

Source: llm_adapter@2026-06-02

Confidence: high

Bugfix Medium

Fixes managed agent Borg 2 installation problems

Fixes managed agent Borg 2 installation problems

Source: llm_adapter@2026-06-02

Confidence: high

Bugfix Low

Fixes Unicode escapes in JSON logs

Fixes Unicode escapes in JSON logs

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

Full changelog

What's Changed

  • fix(ui): polish cloud OAuth and plan content (391f568c)
  • ci(deps): bump actions/setup-node from 4 to 6 (#595) (4f9d708f)
  • ci(deps): bump actions/upload-pages-artifact from 3 to 5 (#596) (f27cfe58)
  • ci(deps): bump actions/configure-pages from 5 to 6 (#597) (606a4f24)
  • Add saved script hook chains to backup plans (d14380cf)
  • fix(backup-plans): harden database source scripting (9347312e)
  • Simplify database template detail (#588) (fc5b24ff)
  • fix(ui): rclone OAuth polish + center empty-state icons (#591) (bd155419)
  • Show auto-filled script values in backup plan wizard (#587) (72a622b1)
  • Always run visual reports, clean closed PRs, and filter noise (8f513ec5)
  • Publish visual regression reports on GitHub Pages (03ee9ec0)
  • Require paired rclone OAuth app credentials (e3fe42d3)
  • Fix SQLite scan detection paths (#584) (740b4d00)
  • Move Storybook visual snapshots to Argos CI (#583) (4f7a87a9)
  • feat(ui): add target picker to backup plan database tab (6f07737c)
  • fix(ui): shrink database scan dialog to 80vh (331fb68f)
  • fix(ui): pack repo health cards densely instead of stretching peers (752bfc0f)
  • fix(ui): remove unused snapshot import (201c47f3)
  • feat(ui): expand responsive snapshot coverage (d3a1e65b)
  • Fix backup plan wizard typing latency (17e707dd)
  • Fix package reinstall crash and install toast interpolation (04026a9f)
  • fix(database): fall back to python for SQLite dumps (60f306de)
  • fix(backup-plans): show real database source paths (134224f1)
  • Instrument recent feature flows with Umami analytics (694c82b2)
  • Gate paid backup source workflows (73eea336)
  • fix(frontend): clean database source lint warnings (ba4cbacb)
  • Quiet exhaustive-deps lint in scan dialog and source selector (a2eed69c)
  • test(storybook): refresh database scan snapshots (9ab248dc)
  • feat(backup-plans): preserve database source scripts (4f67e859)
  • Refine Script Library table and fix usage count (2462512e)
  • Save cloud mirror settings before background sync (5aa217ad)
  • Link repositories to filtered backup plans (70ea36e1)
  • Fix dashboard mobile overflow and tidy top bar / activity header (afe4c13d)
  • Rework active backup run card and surface running plans at top of Plans tab (a185a647)
  • feat(ui): add shared backup plan select (c73bfa52)
  • Render managed agents without beta gating (bfcec3f3)
  • feat(ui): reuse shared browser for rclone paths (aac44caf)
  • Use shared log viewer for managed agents (1683dd22)
  • feat(ui): add shared rclone remote select (796b97ac)
  • Sort repository health with bucket-aware secondary key (19a19d06)
  • Fix theme card layout so icon anchors title, not description (70840a91)
  • fix: delete restore check jobs with repository (d663b628)
  • fix: remove remote machines stats bar (72e80fb0)
  • Reorganize sidebar IA: INFRASTRUCTURE + STORAGE groups, Users under Management (66f9ec9e)
  • fix(repositories): preserve storage mode on edit (db8e23a4)
  • fix: infer ssh key for legacy remote repos (9bb6dd4b)
  • Polish dashboard: brand color, lane chart, variable density, failure strip (90ffd7a1)
  • Lay out dimension footer as 2x2 grid so labels fit (a51c69d1)
  • Enable Borg 2 rclone storage selection and browsing (f3ec46b6)
  • Fix managed agent archive downloads (d8ada6bb)
  • Improve managed agent refresh status (fec060b8)
  • Add managed agent default browse paths (671b15f5)
  • Fix agent installer service user config ownership (e8625978)
  • fix(backup-plans): reuse shared source chooser controls (1385b316)
  • chore: hide back button for db scanning (7659254a)
  • docs(ui): document shared component folder contract (d07ba958)
  • refactor(ui): move wizard shell into shared components (95514e15)
  • refactor(ui): move product primitives into shared components (c3c558ec)
  • refactor(ui): move CodeEditor into shared components (04de1d78)
  • refactor(ui): move schedule controls into shared components (6f3dae0e)
  • refactor(ui): move connection selects into shared components (f3598ef0)
  • refactor(ui): move DestinationSelect into shared components (9fa54f30)
  • refactor(ui): move RichSelectRow into shared components (1c780505)
  • refactor(ui): move ResponsiveDialog into shared components (2e555089)
  • docs(ui): plan shared component folder migration (c483ebea)
  • refactor(ui): add reusable DestinationSelect (03e9b849)
  • Redesign rclone remote dialog with progressive disclosure (f66ebe47)
  • Capture final dashboard critique snapshot (57e50e7d)
  • Make repo health grid auto-fit and i18n the plan chip (4b2a2664)
  • Quieten WizardDialog surface and tokenize EntityCard accents (353361c1)
  • Distill dashboard donuts, prune dead tokens left by quieter pass (0dda064b)
  • Capture post-quieter critique snapshot for DashboardV3 (2a674f07)
  • Quieten DashboardV3: strip glass, glow, and pulse layers (818f956f)
  • Extract shared SSH/agent selectors and pivot source picker (2343d2fe)
  • Fix WCAG AA contrast at the design token layer (0d056f1e)
  • Add PRODUCT.md, DESIGN.md, and impeccable project context (769f3862)
  • Prevent conflicting Borg check flag durations (0d35c96e)
  • Fix cached rclone repository edit payloads (479bac0d)
  • Also disable Borg UI server source card for agent repositories (4cc7782e)
  • Disable invalid backup sources for agent repositories (452d0e8d)
  • Preserve existing service user during agent reinstall (79c8984c)
  • Streamline Add Agent wizard and add service user installer option (3d318e35)
  • Redesign repository wizard destination picker (f084508e)
  • Document shared UI components in AGENTS.md (1b1970a9)
  • Dispatch agent repo init with configurable timeout (8e60691e)
  • fix(agent): dispatch backups and browse archives via agent (f075bce4)
  • Allow remote repo location with managed agent execution (98199aa5)
  • Add managed agent reinstall action (90773f25)
  • Polish cloud storage OAuth setup UX (f3ae14ec)
  • Persist Borg cache volume in Docker (776ce702)
  • Add automated Borg UI configuration export (ea205f83)
  • Initialize agent repositories before create success (0dfaac50)
  • Move agent dispatch to live WebSocket sessions (607beb9f)
  • Clarify BorgBase setup documentation (7bfff407)
  • Improve plan drawer contrast accessibility (252df86b)
  • Support direct Borg 2 rclone repositories (57fbe108)
  • chore(symphony): lower agent concurrency (42b107b9)
  • Support Borg UI-owned OAuth callbacks (248c3558)
  • Document direct rclone mount support decision (758034a8)
  • Schedule repository cloud mirror syncs (4fd13974)
  • Add guided cloud storage source setup (ba62456e)
  • Add managed-agent cloud mirror ownership (3345d5e9)
  • Support server-owned cloud mirrors for SSH repositories (fb8c1405)
  • Reuse archive browser for cloud storage browsing (4b1a56d9)
  • Display agent names in path browser (6c57af0e)
  • Remove duplicate repository break-lock route (ea818729)
  • Document hosted and NAS onboarding paths (7d629332)
  • Document app navigation workflow (920ff3fb)
  • Refresh Borg UI Postman collection (933f701f)
  • Add optional cloud mirror for repositories (325c0a09)
  • Remove legacy Borg UI logo assets (24cf11c1)
  • Document BorgBase onboarding paths (2579c936)
  • Split sidebar Backup section into Hosts, Targets, and Backups (8f1094b1)
  • Share PageHeader and ListToolbar across list pages (375aaf84)
  • Add Symphony Linear ticket metadata bootstrap (3bd2944e)
  • Document archive browsing limits (3dace5ec)
  • Implement rclone-backed repository storage (99fd597f)
  • Plan rclone storage integration (d9c92ea3)
  • Fix agent filesystem browse timeouts (553beab5)
  • Implement remote-direct backup execution (70f0406b)
  • Add btrfs and zfs snapshot sources (314f575d)
  • Add SQLite database source parity (4ee8e324)
  • Fix Unicode escapes in JSON logs (f9c30b89)
  • Allow Linear Merging to bypass review-required PRs (675b6b22)
  • Add Code Review Reply workflow mode (6ac7b64f)
  • Fix managed agent Borg 2 installation (eae40fe0)
  • docs(plans): plan remote direct backup execution (#526) (4bf69f8d)
  • Stabilize layout shifts in backup wizards (84560f9d)
  • docs: document rootless Podman permissions (#527) (d25dd495)
  • Install Borg from managed agent setup (#524) (acbf1b4a)
  • Fix managed agent browsing cache and Linux copy (#525) (12fb2637)
  • Move backup cache guidance to troubleshooting (#523) (3a820182)
  • docs: explain slow backup cache behavior (e45b0ef0)
  • Use cron timezone scheduling for backup reports (#521) (3bf3e382)
  • Add managed agent onboarding and path browsing (8d68b887)
  • Document Docker socket proxy hook access (a9e65228)
  • Preserve Borg slash-dot SSH repository paths (#518) (24a26fbe)
  • Track no-fix pip-audit findings (#516) (fac235db)
  • Validate borg-ui-agent systemd service identity (#517) (98ac00ef)
  • Support agent-owned backup plan routing (a8bcedda)
  • Add backup monitoring alerts and reports (92b9c6be)
  • Move agent source capture to backup plans (#513) (aaf7d184)
  • Implement managed-agent repository execution orchestration (dd68431e)
  • docs: plan managed agent orchestration (#510) (7660f0d7)
  • feat(backup-plans): brand SVG icons + 4-col template grid + dropdown alignment (1ef33a29)
  • feat(backup-plans): single-row source group + horizontal db template tiles + fixed modal height (fce5d14c)
  • feat(backup-plans): polish source picker — backgrounds, skeletons, wider modal (c7cd0cd8)
  • fix(backup-plans): tidy SSH option formatting + surface scanned paths (6aef9969)
  • Implement source-aware database scan backend (#509) (81257a31)
  • test(backup-plans): regenerate source picker snapshots (b4159e1a)
  • test(backup-plans): add stories for redesigned source picker (516433b0)
  • feat(backup-plans): redesign source picker around scan-configurable databases (d326c928)
  • test(managed-agents): regenerate fleet overview snapshot (d15a730f)
  • refactor(managed-agents): align with shared design language and drop placeholder backup dialog (cdf0fd18)
  • fix(managed-agents): clarify client setup flow (#506) (3aa4ee95)
  • fix(storybook): keep unchanged snapshot files stable (#505) (79432bc3)
  • Implement secure repository contents wipe flow (#502) (497f3826)
  • Revert "Implement selector-driven Symphony validation" (#504) (c090ef2b)
  • Revert "Allow Linear Merging to bypass review-required PRs" (#503) (b7f1b767)
  • Allow Linear Merging to bypass review-required PRs (03ce19c1)
  • Implement selector-driven Symphony validation (#496) (17459a09)
  • Design secure repository contents wipe flow (#497) (bd762553)
  • Document Synology SSH path prefixes (#498) (89660050)
  • Add managed CLI agent support (#493) (4fd94823)
  • Allow advanced Borg check flags (e0cd0948)
  • Run manual prune as a background job (#494) (6cf28b40)
  • Allow grouped backup source locations (#490) (5d398951)
  • Document Symphony issue-to-PR latency reductions (f8b8f5e7)
  • Update usage guide for Backup Plans (56b092c1)
  • Normalize SSH connection host input (#487) (801c8cf0)
  • feat(ui): add copy-to-clipboard buttons for command previews (41241dd7)
  • Fix Hetzner SFTP child folder browsing (3967b0b7)
  • Add database source discovery flow (7d5e20a8)
  • feat(land): add fast landing preflight (#483) (e99bef0c)
  • Classify SSH deployment DNS failures (2ed3586d)
  • fix(ssh): classify DNS connection-test failures (#484) (04c3122c)
  • Add Storybook snapshots (#480) (4e965ca5)
  • Fix multi-repository plan content label (e1a16fa3)
  • Fix profile menu contrast (2bc1dcff)
  • Security: Path traversal allows arbitrary file download outside temporary extraction directory (6712dc69)

Docker Images

Published to Docker Hub:

docker pull ainullcode/borg-ui:2.2.0
docker pull ainullcode/borg-ui:latest

Full Changelog: https://github.com/karanhudia/borg-ui/compare/v2.1.0...v2.2.0

Security Fixes

  • Security: Path traversal allows arbitrary file download outside temporary extraction directory (CVE not listed) — fixed.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track borg-ui

Get notified when new releases ship.

Sign up free

About borg-ui

Replace complex Borg Backup terminal commands with a beautiful web UI. Create, schedule, and restore backups with just a few clicks.

All releases →

Beta — feedback welcome: [email protected]