Security fixes are released for the latest 4.5.x version. Please upgrade to it before reporting a vulnerability found in an older version.

Do not open a public issue, pull request or discussion for a security vulnerability.

Report it privately through GitHub Private Vulnerability Reporting: Security tab → Report a vulnerability.

Please include as much of the following as you can:

• The affected component (Databox, Expose, Uploader, Dashboard, Configurator, Report, Indexer, Keycloak configuration…) and version
• The type of vulnerability and its impact
• Step-by-step instructions to reproduce it, with a proof of concept if possible
• The configuration needed to reproduce it (deployment mode, relevant environment variables)
• Any suggested fix or mitigation

The maintainers will acknowledge your report as soon as possible, investigate it, and keep you informed of the progress through the private advisory. Once a fix is released, the advisory is published; you will be credited unless you prefer to remain anonymous.

Please give the maintainers a reasonable time to release a fix before any public disclosure.