marcpope/borgbackupserver v2.94.1

on GitHub

🔒 Security fix: update as soon as you can

A user with only the Manage Plans permission on a client could run commands as root on that client. A backup plan's Advanced Options were passed to borg create as typed, and borg has options that turn the plan's directory list into a command line (--content-from-command, --paths-from-command) or name a program to run (--rsh). The agent runs as root on a default Linux install, so the command ran as root. Rated critical, CVSS 9.9. Every release before this one is affected.

The fix: advanced options are checked against an allowlist of borg create options when a plan or template is saved, on the web and over the API, and the command builder only ever emits allowlisted options, so plans saved before this release cannot carry one either. An end-of-options -- now precedes every user-supplied path in create, restore and archive download. Agent 2.94.1 also refuses any borg command that carries a command-executing option, whatever the server sent, and agents update themselves after the server does.

If a plan holds an option that is no longer accepted, the activity log says so when it runs. Options such as --pattern, --exclude-if-present, --chunker-params, --compression and the checkbox flags keep working.

Reported privately by @archnexus707 (GHSA-w6m3-j4cx-8m67) and, independently, by @shashank420 (GHSA-mrq9-2g5p-r8j6). Thank you both for the careful reports and for going through the private channel.

New: redesigned report email

The daily and weekly report opens with what matters: how many clients need attention, then job success rate, data added after deduplication, and clients up to date. A seven-day activity chart follows, then a Needs attention list with the reason for each client (last backup failed, offline, or a schedule that has not run), how long since its last good backup, and a link to the client. Admins get a storage overview with a usage bar per location and BorgBase repository, warnings above 90%, and repository, archive and dedup totals. The header carries the server's icon, so a custom icon shows too.

The storage lines also use each location's stated capacity now, so a WebDAV mount no longer shows the server's cache disk figures (#473).

Agent install behind a self-signed certificate (#476)

The installer takes --cacert /path/to/ca.pem for a self-signed or private-CA certificate, or --insecure. Both are written to the agent's config so the agent can reach the server afterwards, which is where the old -k workaround left people stuck. The start wrapper's recovery download honours the same settings. Based on a PR by @slsgzs-cloud.

Fixes

• BorgBase: restic and borg 2 repositories on the account are listed but cannot be added to BBS, since the server backs up with borg 1.x. They still count toward the plan's repository limit (#468).
• Storage-low push notification names the location and its percentage instead of "a storage location passed your threshold".

API

• POST /api/v1/clients/{id}/repositories/import/verify and POST /api/v1/clients/{id}/repositories/import register an existing repository for a client, local or remote SSH.
• Plan and template endpoints validate advanced options and directories and answer 422 with the reason.
• Report data carries per-client attention reasons, last good backup time, data added after dedup, and per-day activity for BBS Manager.

Agent 2.94.1. Agents update themselves once the server is on this release.

BBS Manager for iOS is on the App Store; connect it under Settings → Push Service.