https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-40348.htmlhttps://patchthecve.com/cve/CVE-2024-40348.htmlWed, 17 Jun 2026 07:45:48 +0000HIGH 8.2: An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.https://patchthecve.com/cve/CVE-2023-50266.htmlhttps://patchthecve.com/cve/CVE-2023-50266.htmlWed, 17 Jun 2026 06:39:24 +0000MEDIUM 5.3: Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allhttps://patchthecve.com/cve/CVE-2023-50265.htmlhttps://patchthecve.com/cve/CVE-2023-50265.htmlWed, 17 Jun 2026 06:39:24 +0000HIGH 7.5: Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1.https://patchthecve.com/cve/CVE-2023-50264.htmlhttps://patchthecve.com/cve/CVE-2023-50264.htmlWed, 17 Jun 2026 06:39:24 +0000HIGH 7.5: Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system.