Frigate NVR Updates: API Hardening and a Path Traversal Fix
This cycle's main story is security hardening around Frigate's API endpoints, including a fix for a path traversal issue that could delete media or config directories, alongside continued cleanup ahead of the 0.18 beta release.
Duration: PT2M29S
Episode overview
This episode is a short developer briefing from Frigate NVR Updates.
It explains recent repository work in plain language.
- Show: Frigate NVR Updates
- Published: 2026-08-14T13:15:46Z
- Audio duration: PT2M29S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day, and welcome to Frigate NVR Updates for August 14th, 2026.
The headline this cycle is security. PR 23990, from Josh Hawkins, hardens API endpoints against a path traversal weakness. The filename sanitizer in use didn't fully neutralize traversal sequences, meaning paths built from face names, classification categories, image IDs, and trigger data could potentially escape…
That same hardening instinct shows up elsewhere. PR 23994, opened by Hawkeye217, adds guard checks for camera lookups when cameras are added or removed while Frigate is running, protecting against runtime state issues in object and review processing. Together with the API fix, the pattern is clear: defensive coding…
A second theme is polish ahead of the 0.18 beta. PR 23981 fixes event categorization so manually created events get flagged as alerts when their label matches an alert label — closing a gap tied to issue 21923. PR 23989 fixes a notification bug where suspend state was lost on page reload, caused by a type mismatch:…
What's next: watch for PR 23993, the miscellaneous 0.18 beta fixes, and PR 23994 to land as review wraps up. Both are still open with comments pending.
That's the briefing for today…
Nearby episodes from Frigate NVR Updates
- Weekly Recap - Runtime Flexibility & Security Hardening
- Core Systems Get a Beta Overhaul
- Audio Grouping and Capture Thread Cleanup
- Core Configuration Gets Sturdier
- GenAI Gets More Flexible, Cleanup Follows
- Birdseye Gets a Rework
- Export Polish and GenAI Lifecycle Fix
- Weekly Recap - Security Hardening & Timing Precision