11-11

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

no vulnerabilities since 2023-07-23

• there is a discord server with an @everyone in case of future important updates
• v1.8.7 (2023-07-23) - CVE-2023-38501 - reflected XSS
• v1.8.2 (2023-07-14) - CVE-2023-37474 - path traversal (first CVE)
  • all serverlogs reviewed so far (5 public servers) showed no signs of exploitation

new features

• u2c.py / u2c.exe (the commandline uploader):
  • -x is now case-insensitive
  • if a file fails to upload after 30 attempts, give up (bitflips)
  • add 5 sec delay before reattempts (configurable with --cd)

bugfixes

• clients could crash the file indexer by uploading and then instantly deleting files (as some webdav clients tend to do)
• and fix some upload errorhandling which broke during a refactoring in v1.9.16

other changes

• upgraded pyftpdlib to v1.5.9

---

⚠️ not the latest version!