Tweakers · Technology

Software Update Navidrome 0.64.1

Navidrome, an open-source media server for personal music collections, has released version 0.64.1. This update focuses heavily on security and improves compatibility with Jellyfin clients.

This version is a security release that addresses five vulnerabilities reported through the GitHub Security Advisory program. The issues concerned Subsonic authentication, artwork retrieval, playlist covers, player ownership, and per-user library filtering. Users are advised to update as soon as possible.

The update also improves support for Jellyfin clients. Both Manet and JellyBox have been tested and validated. Manet now synchronizes the entire library, even with missing fields, and JellyBox no longer gets stuck on the login screen.

Navidrome now reports itself as Jellyfin 12.1.0, accepts Quick Connect logins, and can announce itself on the local network, allowing clients to find it without manual address input.

Smart playlists can now refer to other playlists via their path. The web interface formats dates according to the user's set language.

Multiple security risks have been resolved, including unauthorized password brute-force via the Subsonic API (CVSS 7.4), SSRF via external album artwork (CVSS 6.5), and reading files outside one's own library via playlist covers (CVSS 6.5).

Other resolved security issues include authenticated users taking over players (CVSS 6.4) and bypassing library filters for bookmarks, playlist tracks, and 'now playing' (CVSS 4.3).

New configuration options are Jellyfin.AutoDiscovery for automatic detection on the LAN and Jellyfin.QuickConnect for faster login. The update also includes improvements to the Subsonic API, UI, artwork processing, scanner, scrobbling, and translations.

AI-samenvatting op basis van de bron.