SECURITY: shadowing on windows/mac

Door: 9001

16 Oktober 2026 om 20:02

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-10-06)

⚠️ ATTN: this release mitigates a Windows/MacOS-specific issue with shadowing

GHSA-3c88-p299-7hvr: due to windows/macos having case-insensitive (casefolding) filesystems, shadowing is not bulletproof, even with this fix

v1.20.25 (2026-10-05) improved shadowing on Windows/MacOS
v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

#1498 --acao-re for allowing cross-domain access with more complex rules ab2299e
#1652 redup: detect and skip hardlinks / reflinks which are already optimally deduplicated 0809357
--sftp-fastldr to improve startup time on extremely old hardware 186cbf9
--sftp-chattr to restrict chattr to certain properties e59fc05

GHSA-3c88-p299-7hvr e8de421
- for further context, torvalds has some technically accurate and colourful opinions (nsfw) on how casefolding filesystems are an ongoing mistake
- on a more serious note, the readme was updated
fix uploads struggling to resume from a network glitch if the server filesystem is FAT32 or exFAT 23e00c0 731dbbf
#1647 shares: fix cleanup of single-file shares when manually deleted before expiration (thx @willie6666!) f445bfa
#1660 ban-pw now more aggressive on failed basic-auth (thx @PAStheLoD!) 5e0a88e
#1656 webdav: return 404 instead of 400 when file didn't exist 74b1737
fix navigating to an index.html webroot (thx @tilse!) 334dccc
fix IP-address detection on Windows XP 107dec9

#1658 constant-time verification of filekeys/dirkeys (thx @rozbb!) a31870c
prevent enabling the smb server unless --hack-me-bro is also enabled because the smb-server was intentionally made super-insecure so it would work with ancient outdated equipment in emergencies and should never be used otherwise 1341b34
now possible to upload 09. t+pazolite - I still think about y%#'()*{\"'&36)%("'$&''&(15y!!!??*`~.flac (dont click that link on acid) 28f9f6f 64f574f