recyclarr

v8.7.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 11d Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 11d

The release fixes a path‑traversal vulnerability in config templates (GHSA-9wh7-8wrf-9x8r) and adds automatic Git resource storage cleanup when the cache exceeds its limit.

Why it matters: Patches a critical file‑access flaw; enables auto‑cleanup of Git caches exceeding the default 100 MB limit.

Summary

AI summary

Config template manifests fixed a path‑traversal vulnerability (GHSA-9wh7-8wrf-9x8r), Git resources now auto‑cleanup storage over the cache limit, and Sync crashes/warnings were resolved.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Fixes path traversal vulnerability allowing arbitrary file read/write in config templates (GHSA-9wh7-8wrf-9x8r) Fixes path traversal vulnerability allowing arbitrary file read/write in config templates (GHSA-9wh7-8wrf-9x8r) Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Automatically cleans up Git resource provider storage when `.git` directory exceeds configurable `cache_limit` (default 100MB) (#815) Automatically cleans up Git resource provider storage when `.git` directory exceeds configurable `cache_limit` (default 100MB) (#815) Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes crash when two custom formats from different providers resolve to the same service custom format Fixes crash when two custom formats from different providers resolve to the same service custom format Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Adds warning when an explicitly-added CF group is skipped due to profile incompatibility (#822) Adds warning when an explicitly-added CF group is skipped due to profile incompatibility (#822) Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Ensures CLI error messages are visible when stdout is redirected (e.g., piped commands, cron jobs, CI) Ensures CLI error messages are visible when stdout is redirected (e.g., piped commands, cron jobs, CI) Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

Added

Git resource providers automatically clean up accumulated storage when the .git directory
exceeds a configurable size threshold (cache_limit, default 100MB) (#815)

Security

Config: Template manifest entries from resource providers could escape the intended directories
via path traversal, enabling arbitrary file read and write outside the config directory
(GHSA-9wh7-8wrf-9x8r)

Fixed

Sync: Crash when two custom formats from different providers resolve to the same service custom
format (e.g. a custom provider CF duplicating a TRaSH guide CF by name)
Sync: No warning when an explicitly-added CF group is skipped because the profile is not in its
compatibility list (#822)
CLI: Error messages not visible when stdout is redirected (e.g. piped commands, cron jobs, CI)

Security Fixes

GHSA-9wh7-8wrf-9x8r — Config template manifest entries could perform path traversal, allowing arbitrary file read/write outside the config directory.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track recyclarr

Get notified when new releases ship.

About recyclarr

Automatically sync TRaSH Guides to your Sonarr and Radarr instances

All releases →