'/%3e%3cpath%20id='cross_2'%20data-name='cross%202'%20class='cls-2'%20d='M20.612,30.43h0a5.361,5.361,0,1,0-10.723,0H0A33.709,33.709,0,0,1,30.569,0V9.75a5.361,5.361,0,1,1,0,10.723V30.43Z'%20transform='translate(67.193%200.007)%20rotate(90)'/%3e%3cpath%20id='cross_3'%20data-name='cross%203'%20class='cls-3'%20d='M20.612,30.43h0a5.361,5.361,0,1,0-10.723,0H0A33.709,33.709,0,0,1,30.569,0V9.75a5.361,5.361,0,1,1,0,10.723V30.43Z'%20transform='translate(67.186%2067.041)%20rotate(180)'/%3e%3cpath%20id='cross_4'%20data-name='cross%204'%20class='cls-4'%20d='M20.6,30.5h0a5.361,5.361,0,1,0-10.723,0H0A33.71,33.71,0,0,1,30.56,0V9.818a5.361,5.361,0,1,1,0,10.723V30.5Z'%20transform='translate(0%2067.041)%20rotate(-90)'/%3e%3c/svg%3e)
Security Review Log
This page records the security reviews SetFN has performed, newest first. Each entry lists the scope of the review, the issues found, and their remediation status. The status labels are the same as in Vulnerability Status.
To avoid revealing how an issue could be exploited, each entry describes the impact and the fix rather than the steps to reproduce it.
2026-10-24 AI cross-review and follow-up actions
OpenAI Codex re-reviewed, read-only, the fixes Claude made in review rounds 1 to 3. The review covered both whether the code was fixed as intended and the usability of the screens (UI/UX). Each finding was confirmed in the code, only actual defects were fixed, and Codex re-reviewed the fixes repeatedly, five rounds in all, until no blocking issue remained. The items left open after the third round (administrator two-factor authentication, length-based password rules, and TinyMCE) were also handled on this day.
Issues found and actions taken
| Area | Description | Status |
|---|---|---|
| Authentication | Added authenticator app two-factor authentication (with recovery codes) for administrator accounts, and added the Require two-factor authentication for administrators policy, which every administrator must comply with, to Security Settings. See Set up administrator two-factor authentication. | Fixed (pending release) |
| Authentication | Setting up or turning off two-factor authentication ends the account's other sessions. The required policy also applies to live connections that are already open and to MCP tasks in progress, and changing the password invalidates a pending sign-in step. | Fixed (pending release) |
| Authentication | Changed the default password rules for newly installed servers to at least 12 characters with no required mix of character types (NIST SP 800-63B-4). The setup wizard and the command-line tool follow the same rule, and the rules of existing servers do not change. | Fixed (pending release) |
| Editors | Replaced the bulk notice mail editor with Tiptap and removed the visual editor (TinyMCE) for HTML files. The unfixed vulnerabilities remaining in TinyMCE 6 no longer have any effect. HTML files are edited as source code only. | Fixed (pending release) |
| Permissions | The requesting user's permission is now checked for images inserted by presentations, sheets, and automatic conversion, and for the content of similar-image search and AI answer sources. Office preview results can be received only by the person who created them. | Fixed (pending release) |
| Document conversion | TeX formulas inside a document could be used to read files outside the working folder. Files outside the working folder can no longer be read. | Fixed (pending release) |
| Server stability | Document structure is now read in parts during conversion, and the read size of password-protected documents is limited. External conversion tools are marked before they run so that they are terminated first when memory runs low. | Fixed (pending release) |
| Logging | Improved the handling of partially successful unblock operations and added missing items to the audit records of settings changes. | Fixed (pending release) |
| Web UI | A confirmation dialog is now shown when leaving with an unsent bulk mail draft and when leaving without saving recovery codes, and keyboard and screen reader accessibility was improved. | Fixed (pending release) |
| Authentication | Each account now has a credential generation. After all sessions are ended, the password is changed, or two-factor authentication is changed, earlier sessions and the token refreshes and app sign-ins derived from them can no longer be used, even if deleting the sessions failed. | Fixed (pending release) |
| Authentication | Ending all sessions also disconnects MCP OAuth connections made through the sign-in and consent screen. API keys the user created themselves are kept. | Fixed (pending release) |
| Server stability | Blocking live connections no longer waits on slow connections, and password-protected document processing now has limits on concurrent runs and waiting requests. | Fixed (pending release) |
| Authentication | If the server temporarily cannot verify the sign-in state, the client is no longer signed out and retries instead. | Fixed (pending release) |
Remaining limitations
- Because the browser sends the password as a hash, the server cannot enforce the password length rule itself. Length and composition rules are checked in the UI, and common-password blocking is done on the server.
- The policy enforcement state and the pending two-factor authentication state are kept in server memory. After a server restart, a sign-in in progress must be started over.
2026-10-23 Third-round follow-up review
We addressed the follow-up items left from the second-round re-review and the recommendations of international standards documents (the NIST SP 800-63B-4 password guidelines and OWASP Top 10:2025 A09 security logging). Permission issues were first confirmed with a test that fails on the code before the fix, then fixed, and the fixed version was rebuilt and tested from freshly fetched source.
Issues found and actions taken
| Area | Description | Status |
|---|---|---|
| Permissions | Document conversion (the AI conversion tool, document conversion, and Office preview) pulled images from the entire source folder, so images in subfolders that the requesting user could not read could end up in the output file. It now includes only images the requesting user can read. | Fixed (pending release) |
| Permissions | In document conversion, stylesheet and cover paths written in a document could cause the contents of other files on the server to be included in the output file. Stylesheet references and unsafe paths are now removed before conversion. As a result, CSS styles specified in a document are not applied to the conversion output. | Fixed (pending release) |
| Permissions | Knowledge search results and the sources cited in AI answers showed part of a document's body with view permission alone. The body is now shown only when the user has both view and download permission; with view permission alone, only the title and location are shown. | Fixed (pending release) |
| Permissions | Favorites, Office preview and online editing, and edit history did not re-check the access boundary of team space system folders or the current permissions. They are now re-checked on every request, and earlier content in the edit history requires download permission. | Fixed (pending release) |
| Permissions | Aggregates such as sums and averages in website (webspace) tables reflected the values of columns with restricted read access, and row delete permission alone was enough to delete permanently. Unreadable columns are now excluded from aggregates, and permanent deletion is limited to administrators and deployment managers. | Fixed (pending release) |
| Automation | Automations and webhooks could run even when an action such as locking a document had been denied. They now run only when the action succeeds. | Fixed (pending release) |
| Settings | Applying a folder settings bundle could clear the folder's knowledge usage settings. Existing settings are now kept. | Fixed (pending release) |
| Authentication | When a new password is set, about 20,000 commonly used or breached passwords are now blocked (NIST SP 800-63B-4). This applies to sign-up, password change and reset, account creation and password reset by administrators, the command-line tool, and the setup wizard. Signing in with your current password is unaffected. | Fixed (pending release) |
| Logging | Administrator changes to security and policy settings, blocking and unblocking, user permission changes, account creation and deletion, password resets, device approval and denial, and session and CAPTCHA policy changes are now recorded in the audit log. The administrator who made the change, the time, the client IP, and the changed items are recorded; secret values such as passwords and keys are not. | Fixed (pending release) |
| External sharing | The UI was fixed so that, even when an administrator turns off external sharing, the person who created a link can still view and delete existing links. New links cannot be created. | Fixed (pending release) |
| Web UI | New server refusal reasons, such as the AI request limit and waiting for a compressed download, are now shown as messages in the user's language. | Fixed (pending release) |
| Server stability | Opening a large text file (such as a big CSV) loaded the entire file into memory, so when several people opened such files at the same time the server could run out of memory. Files larger than 16MB are now sent in parts. | Fixed (pending release) |
| Server stability | Branding logos and AI image summaries decoded images without checking their width and height. The dimensions are now checked first, and excessively large images are not decoded. | Fixed (pending release) |
| Server stability | Some code that handles mail with broken boundaries or very deep nesting (not currently in use) had no depth limit and could fail to finish. The nesting depth is now limited, and processing stops when an error occurs. | Fixed (pending release) |
| Server stability | If the document conversion, image, or video processing programs used a lot of memory, the SetFN server itself could be terminated instead. These programs are now marked so that they are terminated first when memory runs low. | Fixed (pending release) |
Remaining items
- The items left open in this review, namely administrator two-factor authentication, length-based password rules (as the default for new installations), and the replacement of TinyMCE, were handled in the 2026-10-24 AI cross-review.
2026-10-23 Second-round re-review
After the first round of fixes, we reviewed the whole system again on the same day. We re-examined the first-round fixes for gaps, and used AI (Claude) to review, in separate areas, what the first round had not covered: the scope of permission checks per feature, input handling, the permission boundaries of mail, webhook, and AI tools, the web UI, and secrets and settings. Each issue found was confirmed with a test that fails on the code before the fix, then fixed.
Issues found and actions taken
| Area | Description | Status |
|---|---|---|
| Permissions | In search, the folder tree, realtime files, and the AI file tools, a regular user could target the administrator area (every user's personal space). It can now be opened only by full administrators. | Fixed (pending release) |
| Permissions | A file path could escape into the personal space of another user with a similar name. Added a boundary check to file access in all spaces. | Fixed (pending release) |
| Permissions | The feature that queries database files directly had no path permission check and could open other database files. Added a permission check and blocking of dangerous commands. | Fixed (pending release) |
| Permissions | The AI schedule tool did not check the owner of a schedule, and the AI file tool did not re-check permissions when it read a similarly named file instead. | Fixed (pending release) |
| Permissions | Reinforced the owner checks for personal space activity records, the source permission of copies between spaces, permission checks across differences in Korean jamo representation, favorites, conversion status, and task cancellation. | Fixed (pending release) |
| Permissions | Column read and write restrictions on website (Webspace) tables were not applied. Deleted rows and the author column are now protected as well. | Fixed (pending release) |
| Permissions | If the IP access restriction item was missing when settings were saved, the restriction could be turned off. | Fixed (pending release) |
| Data isolation | Another user's personal schedule could appear in the team schedule list, the inbox, and notifications. | Fixed (pending release) |
| Server stability | Concurrent autocomplete requests could stop the server. | Fixed (pending release) |
| Outbound requests | The AI model connection forwarded regular user requests as far as management functions, and some features could send requests to internal server addresses. Sign-in information being passed to plugins has also been stopped. | Fixed (pending release) |
| Content isolation | Reinforced website static files (XML and XHTML), document conversion previews, branding setting values, the PDF conversion engine, and the redirect address after sign-in. | Fixed (pending release) |
| Overload defense | Request size limits are now based on the feature path, slow request bodies have a time limit, concurrent uploads reserve their storage quota, and IPv6 request limits are grouped by address block. | Fixed (pending release) |
| Data preservation | The original is no longer deleted when optical character recognition (OCR) produces no result. | Fixed (pending release) |
| Web UI | Replaced the mail composer's HTML sanitization with a standard sanitizer (DOMPurify) and protected links that open in a new window. | Fixed (pending release) |
| Editing a contact could affect another user's contacts, and an external mail account could take over an internal company address. Access to inactive mailboxes and to the raw files of shared mailboxes stored in team spaces has also been blocked. | Fixed (pending release) | |
| Files and integrations | A file save lock could also block another user's file with the same name, and names inside a downloaded archive could be extracted into a different folder. Workflow integrations now re-verify the user every time, webhook tokens are masked in logs, and the signature-required setting also applies to existing webhooks. | Fixed (pending release) |
| Sharing | Existing share links stayed open even after external sharing was turned off or the creator's sharing permission was revoked, and the usage limit could be exceeded by concurrent requests. Even with the feature off, creators can still view and revoke their own links. | Fixed (pending release) |
| Permissions | Attachments in 1:1 and group chat rooms could be opened through the file features by other users on the same team. Only participants of that room and administrators can open them now. | Fixed (pending release) |
| Permissions | The response to a folder listing denied for lack of permission could still include information about the items inside the folder. | Fixed (pending release) |
| Permissions | Requests to save a file or record an approval decision could still be carried out after a permission-denied response had been sent. They now stop as soon as access is denied. | Fixed (pending release) |
| Permissions | Added permission checks to the AI tools' folder settings read/write and to results built from file contents (research, similar images, folder analysis). | Fixed (pending release) |
| Settings and secrets | Confirmed that the repository contains no secret keys and that password hashing, token signing, and mail account encryption are appropriate. Stopped the API documentation page from being exposed through the reverse proxy, and removed an unused weak cryptographic function. | Fixed (pending release) |
Guidance for operators
- If an external AI integration (AP bridge) uses
/api/ai-proxy, the sameSETFN_AI_PROXY_TOKENvalue must be set on both the server and the integration side. Starting with this fix, local requests alone can no longer access it without the token.
2026-10-23 Full pre-release security review
Prompted by reports of an attack type that targets low-memory conditions, we reviewed the whole server again before release. The code was reviewed with AI (Claude) in five separate areas, and the issues found were confirmed in the code and with tests before being fixed.
Review scope
- Request size and connection time of features that can be called without signing in
- Paths where one user's request data could be mixed into another user's response
- Paths where incomplete data could be saved as valid data
- State that keeps accumulating in server memory as requests repeat
- Known vulnerabilities in server and web UI libraries, and major vulnerabilities since 2025 in document processing programs
- 463 KISA (KrCERT/CC) security notices (2025-01-01 to 2026-10-22)
- OWASP Top 10:2025, OWASP ASVS 5.0, NIST SP 800-63B-4, and the KISA web vulnerability checklist
Issues found and actions taken
| Area | Description | Status |
|---|---|---|
| Data isolation between users | File name autocomplete could show file names from other users' personal spaces. The index is now split by space and by user, and the administrator space is visible only to administrators. | Fixed (pending release) |
| Data isolation between users | When team and personal schedules were queried at the same time, another user's personal schedule could appear mixed in. The schedule storage location is now fixed for each request. | Fixed (pending release) |
| Data isolation between users | Restoring a file from the trash over a file with the same name could change the comments and change history of a different file. | Fixed (pending release) |
| Server stability | If the connection dropped while search results were being streamed, a write was still attempted after the response had ended, which could stop the server. | Fixed (pending release) |
| Server stability | Resolved a race where several tasks read and wrote the current screen information of a realtime connection at the same time. | Fixed (pending release) |
| Overload defense | Server connections had no time limit, leaving the server vulnerable to attacks that hold many slow connections open. Added limits on header read time, idle connection time, and header size. | Fixed (pending release) |
| Overload defense | Some features had no request body size limit. Added a default cap for the whole API and individual caps for the unauthenticated endpoints: app sign-in preparation, device registration check, and the setup page. | Fixed (pending release) |
| Overload defense | Sign-in failure records and pending app sign-in requests could grow without bound. Added caps on the total count and on the count per client location. | Fixed (pending release) |
| Overload defense | Mail deduplication records, website realtime subscriptions, concurrent AI requests, concurrent archive downloads, and the folder tree cache could grow without bound. Added a cap and periodic cleanup to each. | Fixed (pending release) |
| Data preservation | An upload without a declared length could skip the storage quota check, and setting a document password overwrote the file in place, so a failure could damage the original. The quota is now checked while counting the bytes received, and setting a document password and saving conversion results now write to a temporary file first and then swap it in. | Fixed (pending release) |
| Data preservation | An oversized patent XML file could be processed truncated and the original then deleted. Files over the size limit are now treated as failures, and a partially parsed original is never deleted. | Fixed (pending release) |
| Document processing programs | LibreOffice has a vulnerability (CVE-2026-63277) that is not yet fixed on Ubuntu 24.04. Java is now disabled in the LibreOffice profile used for document conversion. | Fixed (pending release) |
| Document processing programs | Reinforcing the size limits applied when processing archive, image, and document files. | In progress |
| Dependencies | Upgraded 41 known vulnerabilities in Go server libraries to fixed versions, and replaced an archive library that is no longer maintained with an in-house module. | Fixed (pending release) |
| Dependencies | Upgraded 20 high-severity or higher vulnerabilities in web UI libraries (document editor, PDF viewer, Markdown viewer, and others) to fixed versions. | Fixed (pending release) |
| Dependencies | Some vulnerabilities in the HTML file editor (TinyMCE) are fixed only in a later major version, so a migration is under review. The mail editor is protected by input sanitization. | In progress |
| Security headers | Prevented the admin and account pages from being embedded in other sites, and restricted content type sniffing of API responses and the address information passed to external sites. | Fixed (pending release) |
| Authentication | Planning to change the password policy to the NIST approach (length and blocking of common passwords instead of composition rules) and to add two-factor authentication for administrators. | Planned improvement |
| External notices | No KISA notice directly affected SetFN. The 32 notices that apply depending on the operating environment were compiled as items for operators to check. | Operator action required |
Verification of the fixes
Each fix comes with a test that fails on the code before the fix. After fixing, we started a separate test server isolated from production data, created an administrator account and a regular user account with the command-line tool, and confirmed the following with real requests.
- File names from other users' personal spaces do not appear in autocomplete
- While team and personal schedules are queried 40 times concurrently, no personal schedule is mixed into the team list
- The server closes a slow connection that never finishes sending its headers once the time limit passes
- Oversized requests and long inputs are rejected before the body is read
- The clickjacking protection header is added to the admin pages and not to customer website pages
Guidance for operators
- Added a new document, Checking Server Security Updates. It explains how to receive security fixes for Ubuntu
universepackages and why MuPDF should not be installed. - Removed
mupdf-toolsfrom the recommended packages in the Linux and Windows installation documents.
2026-10-20 to 2026-10-22 Permission boundary re-review
The permission and sharing code was reviewed again in parallel with AI (OpenAI Codex). Each defect found was confirmed with a test that failed on the code before the fix, then fixed.
| Description | Status |
|---|---|
| The desktop sync listing included the names and file sizes of folders the user had no permission to list | Resolved |
| Permission handling defects in share links, trash restore, and document transfer, and permission denials that appeared as server errors (500) | Resolved |
| An ordering issue that could let a revoked permission come back on a realtime connection, and the recipient scope of file notifications | Resolved |
| AI responses that arrived late were visible in a chat room the user had already left | Resolved |
| Added missing permission checks to the document conversion menu and to saving OCR results | Resolved |
2026-10-19 Limiting raw request text in AI logs
Reduced what the diagnostic logs of AI features record so that raw request text is not kept excessively. Resolved
2026-10-13 Conversion and public web permission hardening
| Description | Status |
|---|---|
| The reprocess function for conversion folders had no path permission check | Resolved |
| Changed the default for folders without conversion settings from deleting the original to keeping it | Resolved |
| Hardened public web read permissions and document history boundaries, and fixed a regression in realtime connection re-authentication | Resolved |
2026-09-25 Comprehensive security review
Reviewed permissions, sharing, authentication, cross-site scripting (XSS), server-side request forgery (SSRF), and AI and workflow tools. Issues were confirmed by sending real requests to an isolated test server before being fixed.
| Description | Status |
|---|---|
| Stricter validation of share link tokens by type, issuer, and path scope | Resolved |
| Permissions are now evaluated after path normalization, and parent folder permissions apply to listing as well | Resolved |
| Tightened CSRF exemption conditions, included the port in CORS origin comparison, and ended all sessions on password change | Resolved |
| Applied path permissions and folder policies to Office document save and lock | Resolved |
| Prevented AI tools from receiving internal arguments, and applied permissions and edit locks to file creation and overwrite | Resolved |
| Required a token for workflow integration and applied permission checks to file tools | Resolved |
| Stronger HTML sanitization when displaying mail, Markdown, and Word documents, and isolated responses for uploaded files | Resolved |
| Added an exception for IPs with a recent successful sign-in so that account lockout cannot be abused | Resolved |
| Stronger permission checks for administrator actions in realtime features (such as forced removal) | Resolved |