Security release v1.18.2 – please upgrade!

[BobWs]

Flatnotes-Enhanced v1.18.2 is a security release. It fixes four vulnerabilities that were reported privately, and upgrading is recommended for every installation.

Advisory: GHSA-ghpp-xhqw-4hg8

What was fixed

• Stored cross-site scripting in the note viewer
• Path traversal through note paths
• read_only mode not blocking all write routes
• Uploaded HTML/SVG files able to run script when opened directly

All versions up to and including v1.18.1 are affected.

How to upgrade

• Docker / Docker Compose: pull the new image and recreate the container, e.g. docker compose pull && docker compose up -d
• From source: update to the v1.18.2 tag and rebuild the client

No configuration changes or data migration are needed. Your notes and settings stay as they are.

What changes for you

• HTML, SVG and XML attachments opened directly in the browser now show as static content and no longer run scripts. Images, PDFs and downloads work as before, and SVG images in notes and as logo/favicon still render.
• Note titles or folder paths that start or end with /, contain //, or contain a . or .. segment are now rejected.

If you can't upgrade yet

• Keep the instance off the public internet (VPN or an authenticating reverse proxy).
• Don't rely on read_only mode as access control; block PUT, POST, PATCH and DELETE at the reverse proxy.
• Don't open attachments of unknown origin directly in the browser.

Thanks

Thanks to @AI-the-floog for reporting these issues privately and responsibly.

If you run into a problem after upgrading, please open an issue (not for security problems; for those, use the private "Report a vulnerability" button in the Security tab).