This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+4 more
Affected surfaces
ReleasePort's take
Moderate signalWebDAV storage now rejects private and loopback destinations and replaces a vulnerable trailing‑slash regex with linear path processing.
Why it matters: These changes block prohibited destination access and eliminate pathological regex attacks, reducing security risk for WebDAV deployments.
Summary
AI summaryWebDAV storage hardens against prohibited destinations and mitigates pathological regex attacks.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Rejects private, loopback, link-local, internal-DNS, and DNS-rebinding destinations for WebDAV storage. Rejects private, loopback, link-local, internal-DNS, and DNS-rebinding destinations for WebDAV storage. Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Security | High |
Replaces ambiguous trailing-slash regex with linear path processing for WebDAV paths. Replaces ambiguous trailing-slash regex with linear path processing for WebDAV paths. Source: llm_adapter@2026-06-10 Confidence: high |
— |
Full changelog
Security
- WebDAV document storage: UI-managed targets now reject private, loopback, link-local, internal-DNS, and DNS-rebinding destinations both before persistence and during socket lookup. Trusted private-network targets remain available through
DOCUMENT_STORAGE_WEBDAV_URL. - WebDAV path normalization: replaced ambiguous trailing-slash regular expressions with linear path processing to prevent polynomial-time matching on attacker-controlled configuration.
Security Fixes
- WebDAV UI-managed targets now reject private, loopback, link‑local, internal‑DNS, and DNS‑rebinding destinations both before persistence and during socket lookup; trusted private‑network targets remain configurable via `DOCUMENT_STORAGE_WEBDAV_URL`.
- WebDAV path normalization replaced ambiguous trailing‑slash regexes with linear processing to prevent polynomial‑time matching attacks on attacker‑controlled configuration.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v0.71.3 Changes WebDAV backup default path from "/oikos/backups/" to "/yuvomi/backups/".
- v0.66.0 Repository URL changed to `https://github.com/ulsklyc/yuvomi`.
- v0.66.0 Docker image moved to `ghcr.io/ulsklyc/yuvomi`.
- v0.66.0 Project renamed from Oikos to Yuvomi.
- v0.62.0 Changes event dialog to unified sync target picker across Google and CalDAV calendars.
Beta — feedback welcome: [email protected]