Skip to content

writefreely

v0.17.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 9d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

activitypub beta blogging federation go markdown
+5 more
publishing web writefreely writers writing

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal
editorial:auto 8d

This release patches two critical security issues – a world‑readable config.ini permission (CVE-2025-24337) and an IDOR exposing subscriber lists (GHSA-cfcq-76gr-62x8).

Why it matters: Critical severity CVEs require immediate attention; patch to v0.17.0 now.

Summary

AI summary

Updates Dependencies and minor fixes, User-Facing Changes, and Admin-Facing Changes across a mixed release.

Changes in this release

Security Critical

Fixes config.ini default world‑readable permission (CVE-2025-24337)

Fixes config.ini default world‑readable permission (CVE-2025-24337)

Source: llm_adapter@2026-07-18

Confidence: high

 —
Security Critical

Prevents Cross‑User IDOR subscriber list disclosure (GHSA-cfcq-76gr-62x8)

Prevents Cross‑User IDOR subscriber list disclosure (GHSA-cfcq-76gr-62x8)

Source: llm_adapter@2026-07-18

Confidence: high

 —
Security High

Blocks sign‑ups via /auth/signup when registrations are closed

Blocks sign‑ups via /auth/signup when registrations are closed

Source: llm_adapter@2026-07-18

Confidence: high

 —
Feature Medium

Adds support for alternative smallweb URL schemes

Adds support for alternative smallweb URL schemes

Source: llm_adapter@2026-07-18

Confidence: high

 —
Feature Low

Adds Markdown preview in classic editor

Adds Markdown preview in classic editor

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

 —
Dependency Low

Bumps github.com/stretchr/testify from 1.9.0 to 1.10.0

Bumps github.com/stretchr/testify from 1.9.0 to 1.10.0

Source: llm_adapter@2026-07-18

Confidence: high

 —
Dependency Low

Bumps golang.org/x/net from 0.43.0 to 0.44.0

Bumps golang.org/x/net from 0.43.0 to 0.44.0

Source: llm_adapter@2026-07-18

Confidence: high

 —
Bugfix Medium

Limits password length to bcrypt’s maximum supported characters

Limits password length to bcrypt’s maximum supported characters

Source: llm_adapter@2026-07-18

Confidence: high

 —
Bugfix Medium

Improves and fixes data export functionality

Improves and fixes data export functionality

Source: llm_adapter@2026-07-18

Confidence: high

 —
Bugfix Medium

Fixes character set for post signature column on MySQL/MariaDB instances

Fixes character set for post signature column on MySQL/MariaDB instances

Source: llm_adapter@2026-07-18

Confidence: high

 —
Bugfix Medium

Redirects /read/feed to correct /read/feed/ URL

Redirects /read/feed to correct /read/feed/ URL

Source: llm_adapter@2026-07-18

Confidence: high

 —
Bugfix Low

Fixes missing user navigation on blog Customize page

Fixes missing user navigation on blog Customize page

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

 —
Refactor Low

Refactors Email Subscription shortcode and form implementation

Refactors Email Subscription shortcode and form implementation

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

 —
Full changelog

WriteFreely v0.17 is here, includes some critical security fixes, along with a ton of quality-of-life improvements and fixes for users.

Security

  • Fix config.ini defaults to world-readable (by @thebaer, CVE-2025-24337)
  • Fix Cross-User IDOR: Subscriber List Disclosure (by @thebaer, GHSA-cfcq-76gr-62x8)
  • Prevent signups via /auth/signup with closed registrations by @thebaer in https://github.com/writefreely/writefreely/pull/1686

User-Facing Changes

  • Title fixes for ActivityPub by @thebaer in https://github.com/writefreely/writefreely/pull/1491
  • Fix collection Customize page header nav on single-user instances by @thebaer in https://github.com/writefreely/writefreely/pull/1505
  • Fix single-user blog URL on Customize page by @thebaer in https://github.com/writefreely/writefreely/pull/1508
  • Add support for alternative smallweb URL schemes by @smazmi in https://github.com/writefreely/writefreely/pull/1565
  • Fix font toggle in classic editor #876 by @vtyeh in https://github.com/writefreely/writefreely/pull/1135
  • Display stat numbers as monospace by @lolbinarycat in https://github.com/writefreely/writefreely/pull/1142
  • Support changing published post font on web by @thebaer in https://github.com/writefreely/writefreely/pull/1609
  • Fix character set for post signature column on MySQL / MariaDB instances by @thebaer in https://github.com/writefreely/writefreely/pull/1608
  • Redirect /read/feed to correct /read/feed/ URL by @thebaer in https://github.com/writefreely/writefreely/pull/1522
  • Fix ProseMirror HTML handling by @thebaer in https://github.com/writefreely/writefreely/pull/1644
  • Use datetime picker on Post Metadata page and fix API inconsistency by @thebaer in https://github.com/writefreely/writefreely/pull/1492
  • Markdown preview by @thebaer in https://github.com/writefreely/writefreely/pull/1647
  • Sort list of Fediverse followers by subscription date, descending by @thebaer in https://github.com/writefreely/writefreely/pull/1630
  • Limit password to max characters supported by bcrypt by @thebaer in https://github.com/writefreely/writefreely/pull/1664
  • Improve and fix up data exports by @thebaer in https://github.com/writefreely/writefreely/pull/1623
  • Fix missing user nav on blog Customize page by @thebaer in https://github.com/writefreely/writefreely/pull/1687

Admin-Facing Changes

  • Document MariaDB support in README by @robertsilen in https://github.com/writefreely/writefreely/pull/1665
  • Ignore missing socket file on shutdown by @thebaer in https://github.com/writefreely/writefreely/pull/1503
  • ActivityPub robustness and monitoring by @blacklight in https://github.com/writefreely/writefreely/pull/1437

Developer-Facing Changes

  • Don't add blank strings to mentioned users array in Activity object by @thebaer in https://github.com/writefreely/writefreely/pull/1575
  • Refactor: Email Subscription shortcode and form by @thebaer in https://github.com/writefreely/writefreely/pull/1646
  • Run goimports on project by @thebaer in https://github.com/writefreely/writefreely/pull/1559

Dependencies and minor fixes

  • Add missing hostName assignment in viewEditCollection by @thebaer in https://github.com/writefreely/writefreely/pull/1504
  • Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1151
  • Bump docker/metadata-action from 4.6.0 to 5.8.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1462
  • Bump docker/login-action from 3.0.0 to 3.5.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1463
  • Bump docker/build-push-action from 5.0.0 to 6.18.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1464
  • Bump docker/setup-buildx-action from 3.0.0 to 3.11.1 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1465
  • Bump golang.org/x/net from 0.43.0 to 0.44.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1500
  • Bump docker/login-action from 3.5.0 to 3.6.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1497
  • Bump golang.org/x/crypto from 0.41.0 to 0.42.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1499
  • Bump golang.org/x/net from 0.45.0 to 0.46.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1509
  • Bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1528
  • Bump golang.org/x/net from 0.47.0 to 0.48.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1548
  • Bump golang.org/x/crypto from 0.45.0 to 0.46.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1546
  • Bump github.com/fatih/color from 1.17.0 to 1.18.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1140
  • Bump github.com/gosimple/slug from 1.14.0 to 1.15.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1232
  • Bump golang.org/x/net from 0.48.0 to 0.49.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1571
  • Bump docker/login-action from 3.6.0 to 3.7.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1567
  • Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1541
  • Bump docker/metadata-action from 5.8.0 to 5.10.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1525
  • Bump docker/setup-qemu-action from 3.0.0 to 3.7.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1515
  • Bump docker/build-push-action from 6.18.0 to 6.19.2 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1602
  • Bump golang.org/x/net from 0.49.0 to 0.51.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1627
  • Bump docker/login-action from 3.7.0 to 4.0.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1631
  • Bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1632
  • Bump docker/metadata-action from 5.10.0 to 6.0.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1633
  • Bump docker/build-push-action from 6.19.2 to 7.0.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1634
  • Bump golang.org/x/net from 0.51.0 to 0.53.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1657
  • Bump github.com/fatih/color from 1.18.0 to 1.19.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1641
  • Bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1653
  • Bump golang.org/x/net from 0.53.0 to 0.55.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1673
  • Bump golang.org/x/crypto from 0.51.0 to 0.53.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1674
  • Bump docker/setup-buildx-action from 3.12.0 to 4.1.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1669
  • Bump actions/checkout from 4 to 7 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1684
  • Bump docker/build-push-action from 7.0.0 to 7.2.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1666
  • Bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1667
  • Bump docker/login-action from 4.0.0 to 4.2.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1668
  • Bump github.com/gorilla/csrf from 1.7.2 to 1.7.3 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1361
  • Bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1693
  • Bump docker/login-action from 4.2.0 to 4.3.0 by @dependabot[bot] in https://github.com/writefreely/writefreely/pull/1695

Upgrading from v0.16.x or earlier

  1. Download the latest release for your operating system and architecture
  2. Stop running your writefreely server
  3. Replace all files in your installation (except for the keys directory) with the ones in the archive
  4. Update your database by running:
    writefreely db migrate
  5. Start your writefreely server again

If you're upgrading from a much earlier version, follow the instructions in each previous release.

New Contributors

Thank you to all who contributed to this release!

  • @smazmi made their first contribution in https://github.com/writefreely/writefreely/pull/1565
  • @blacklight made their first contribution in https://github.com/writefreely/writefreely/pull/1437
  • @lolbinarycat made their first contribution in https://github.com/writefreely/writefreely/pull/1142
  • @robertsilen made their first contribution in https://github.com/writefreely/writefreely/pull/1665

Full Changelog: https://github.com/writefreely/writefreely/compare/v0.16.0...v0.17.0

Security Fixes

  • CVE-2025-24337 – config.ini defaults now set to non‑world‑readable
  • GHSA-cfcq-76gr-62x8 – Prevented Cross‑User IDOR subscriber list disclosure
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track writefreely

Get notified when new releases ship.

Sign up free

About writefreely

A clean, Markdown-based publishing platform made for writers. Write together and build a community.

All releases →

Related context

Related CVEs

Beta — feedback welcome: [email protected]