spupuz/VibeNVR

v1.25.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ffmpeg lightweight local-storage nvr opensource privacy

+1 more

video-surveillance

Affected surfaces

rce_ssrf breaking_upgrade

Summary

AI summary

Implemented a mandatory Path Traversal Guard for event deletion operations.

Full changelog

What's Changed

chore(deps): bump the npm_and_yarn group across 1 directory with 1 update by @dependabot[bot] in https://github.com/spupuz/VibeNVR/pull/7

New Contributors

@dependabot[bot] made their first contribution in https://github.com/spupuz/VibeNVR/pull/7

Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.25.2...v1.25.3

🚀 Release v1.25.3

📝 Summary

This patch release consolidates critical security hardenings, native UniFi Protect support, and a complete UI modularization of the Event Timeline. The focus is on system integrity and efficient asset management through new bulk operations and a mandatory path traversal guard.

🛠️ Key Improvements

🛡️ Security: Implemented a mandatory Path Traversal Guard for all event deletion operations. Every file-system interaction is now verified against the /data/ storage prefix, mitigating malicious traversal attempts.
🚀 UniFi Protect: Native support for RSTSPS/RTSP protocols, including automatic TLS verification handling for UniFi NVR controllers.
🧩 Architecture: Full modularization of the Timeline.jsx component. Logic is now cleanly separated into specialized sub-components (HourTimeline, EventCard, etc.), improving maintainability and performance.
📊 Bulk Operations: Introduced new API endpoints and Frontend logic for Bulk Delete and Delete All events, significantly streamlining storage management.
📝 Documentation: Synchronized all repository guides, AGENTS instructions, and the project Wiki to reflect the latest security patterns and API capabilities.