Oikos

v1.7.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 16d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

docker family family-planner home-automation planner-app privacy-first

+4 more

progressive-web-app pwa self-hosted selfhosted-apps

Affected surfaces

breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 11d

Version v1.7.0 adds an optional local folder storage backend for documents and fixes a path traversal vulnerability in that backend.

Why it matters: The release patches a high‑severity (severity 90) path traversal flaw affecting the new local folder document storage, requiring attention from security engineers.

Summary

AI summary

Documents can be stored locally with validation preventing path traversal.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Critical	Fixes path traversal vulnerability in local folder document storage. Fixes path traversal vulnerability in local folder document storage. Source: llm_adapter@2026-07-15 Confidence: low	—
Security	High	Validates storage keys against path traversal in local folder backend. Validates storage keys against path traversal in local folder backend. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Security	High	Fails upload loudly on unwritable mount instead of silent fallback. Fails upload loudly on unwritable mount instead of silent fallback. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature	Low	Adds optional local folder storage backend for documents. Adds optional local folder storage backend for documents. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	UI now shows active document upload target and "Local folder" badge. UI now shows active document upload target and "Local folder" badge. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

Added

Documents: optional local folder storage backend. With DOCUMENT_STORAGE_LOCAL_ENABLED=true, new document files and calendar attachments are written to a mounted host folder (DOCUMENT_STORAGE_LOCAL_PATH, default /documents) instead of the SQLite database, keeping the database small and letting other self-hosted tools share the same files. When enabled it takes precedence over WebDAV; existing database and WebDAV documents are not migrated and stay readable. Configurable in the web and CLI installers.
Documents: the storage settings card and the upload and calendar-attachment dialogs now show the active upload target (local folder, WebDAV, or database), and folder-backed documents display a "Local folder" badge in the list.

Security

Documents: the local folder backend validates storage keys against path traversal and fails an upload loudly on an unwritable mount instead of silently falling back to another location.

Security Fixes

Documents: Local folder backend now validates storage keys against path traversal and fails loudly on an unwritable mount rather than silently falling back.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Oikos

Get notified when new releases ship.

About Oikos

Family planner for small households

All releases →

Related context

Related tools

Earlier breaking changes

v0.71.3 Changes WebDAV backup default path from "/oikos/backups/" to "/yuvomi/backups/".
v0.66.0 Repository URL changed to `https://github.com/ulsklyc/yuvomi`.
v0.66.0 Docker image moved to `ghcr.io/ulsklyc/yuvomi`.
v0.66.0 Project renamed from Oikos to Yuvomi.
v0.62.0 Changes event dialog to unified sync target picker across Google and CalDAV calendars.