Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jonaswinkler/paperless-ng

              master @ 3050ed3
            

Fixes

CVEs

HIGH

Peak severity

38.5%

Coverage

Highlights

Denial of Service: 5 prior fixes. Scrutinize any change in this area.

src/documents/mail.py: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The text thumbnail generation process originally passed arguments to a shell execution wrapper, allowing potential shell-interpolation during ingestion parsing. Secure implementations must bypass shell wrappers entirely and pass split, unescaped lists directly to subprocess elements.

Path Traversal: Path validation vulnerabilities allowed potential arbitrary directory deletion or traversal outside the root boundary. Proper defensive measures require combined path canonicalization and explicit prefix validation on all operations managing file paths.

Auth Bypass: Custom implementation of authentication via headers (HTTP_REMOTE_USER) lacked proper integration with Django's core authentication middleware, risking inconsistent session states. Relying on built-in RemoteUserMiddleware fixes this.