High · published October 15, 2025
⚡ An authenticated user can exploit a seemingly innocent video export feature to access sensitive files on your system! Think of it like a hotel guest who can sneak into the staff area by simply asking for an extra towel — a little request opens the door to all sorts of backroom secrets! This vulnerability in Frigate allows low-privilege users to pivot from just viewing camera footage to accessing sensitive configuration files. An attacker could use this vulnerability to exfiltrate sensitive data stored on the host running Frigate, compromising your entire system's security. With a well-timed request, they could obtain user data or secrets, potentially leading to a full breach. This twist turns a convenience feature into a dangerous leak!
Think of it like a hotel guest who can sneak into the staff area by simply asking for an extra towel — a little request opens the door to all sorts of backroom secrets! This vulnerability in Frigate allows low-privilege users to pivot from just viewing camera footage to accessing sensitive configuration files. Prior to version 0.16.2, Frigate's export workflow allowed an authenticated operator to specify any filesystem path, which the system copied verbatim into the public directory. This flaw enables unauthorized file access, violating the principle of least privilege for the export subsystem.
An attacker could use this vulnerability to exfiltrate sensitive data stored on the host running Frigate, compromising your entire system's security. With a well-timed request, they could obtain user data or secrets, potentially leading to a full breach. This twist turns a convenience feature into a dangerous leak! To protect yourself, immediately update Frigate to version 0.16.2 or later. Review user permissions and API access to ensure only trusted users have the ability to interact with video exports. Implement security measures to lock down file access further. You've got this! With these steps, you'll secure your system and enhance your defenses! 🛡️