'/%3e%3cpath%20id='cross_2'%20data-name='cross%202'%20class='cls-2'%20d='M20.612,30.43h0a5.361,5.361,0,1,0-10.723,0H0A33.709,33.709,0,0,1,30.569,0V9.75a5.361,5.361,0,1,1,0,10.723V30.43Z'%20transform='translate(67.193%200.007)%20rotate(90)'/%3e%3cpath%20id='cross_3'%20data-name='cross%203'%20class='cls-3'%20d='M20.612,30.43h0a5.361,5.361,0,1,0-10.723,0H0A33.709,33.709,0,0,1,30.569,0V9.75a5.361,5.361,0,1,1,0,10.723V30.43Z'%20transform='translate(67.186%2067.041)%20rotate(180)'/%3e%3cpath%20id='cross_4'%20data-name='cross%204'%20class='cls-4'%20d='M20.6,30.5h0a5.361,5.361,0,1,0-10.723,0H0A33.71,33.71,0,0,1,30.56,0V9.818a5.361,5.361,0,1,1,0,10.723V30.5Z'%20transform='translate(0%2067.041)%20rotate(-90)'/%3e%3c/svg%3e)
Vulnerability Status
This document summarizes whether major vulnerabilities (CVEs) and KISA (KrCERT/CC) security notices published since 2025 apply to SetFN, and whether review and remediation are complete. It is updated after every new review, and the review date is shown above each table.
Status labels
| Status | Meaning |
|---|---|
Resolved | The fix is included in a SetFN version that has already been released. |
Fixed (pending release) | The fix has been made and verified, and will be included in the next SetFN update. |
In progress | The cause has been identified and a fix is being worked on. |
Planned improvement | A feature improvement to reduce the risk is planned. |
Not applicable | SetFN does not use the component or feature, or there is no affected path. |
Operator action required | The operator must update the operating system or an external program on the server where SetFN is installed. |
SetFN server libraries
Reviewed: 2026-10-23. Vulnerabilities actually called by the SetFN server code were checked with the official Go vulnerability database (govulncheck).
| Component | Vulnerability | Description | Status |
|---|---|---|---|
| Go standard library | GO-2026-6809 | Stop trusting corrupted intermediate certificates | Fixed (pending release) Go 1.26.10 |
| golang.org/x/net | GO-2026-6617, 6612, 6611, 6603, 5030, 5029, 5028, 5027, 5025 | HTTP/2 server crash and memory exhaustion, HTML parsing errors | Fixed (pending release) 0.60.0 |
| golang.org/x/image | GO-2026-6222, 5066, 5062, 5061, 5032, 5031, 4961, 4815 | Memory exhaustion and crash while parsing TIFF, WebP, and BMP images | Fixed (pending release) 0.45.0 |
| excelize (Excel processing) | GO-2026-6689, 6688, 6685, 6684, 6453, 6452, 5960, 6695 | Memory exhaustion and crash caused by crafted Excel files | Fixed (pending release) |
| golang.org/x/text | GO-2026-6629, 5970 | Crash and infinite loop caused by crafted input | Fixed (pending release) 0.42.0 |
| gRPC | GO-2026-6348, 6061, 6443 | HTTP/2 transport memory exhaustion and more | Fixed (pending release) 1.83.2 |
| gorilla/websocket | GO-2026-6278 | Weak random numbers used to generate mask keys | Fixed (pending release) 1.5.3 |
| golang-jwt | GO-2025-3553, GO-2024-3250 | Excessive memory use when parsing token headers, error handling | Fixed (pending release) 4.5.2 |
| ulikunitz/xz | GO-2025-3922 | Memory leak when decompressing corrupted archives | Fixed (pending release) 0.5.15 |
| klauspost/compress, edwards25519 | GO-2026-5841, 4503 | Defects in compression and signature libraries (no call path in SetFN) | Fixed (pending release) |
| mholt/archiver v3, nwaples/rardecode | GO-2025-3605, GO-2024-2698, GO-2025-4020 | Path manipulation during extraction and more. Libraries with no fixed release | Fixed (pending release) Removed the libraries and replaced them with an in-house archive module |
| pion/dtls v2 | GO-2026-4479 | Defect in cryptographic nonce generation. No fixed release | Fixed (pending release) Removed by replacing the dependent library |
After the fixes, a re-scan found no known vulnerabilities called by the SetFN server code.
Web UI libraries
Reviewed: 2026-10-23. Libraries that run in the browser were checked against npm security advisories. Libraries that are not included in the deployed UI, such as build tools, were excluded.
| Component | Description | Status |
|---|---|---|
| prosemirror-view (document editor) | Pasted HTML could execute scripts | Fixed (pending release) 1.42.7 |
| pdf.js (PDF viewer) | A crafted PDF could execute scripts | Fixed (pending release) 6.4.299 |
| Tiptap (document editor) | Excessive regular expression processing time on certain input | Fixed (pending release) 3.32.0 |
| markdown-it, linkify-it (Markdown viewer) | A crafted Markdown document could freeze the page | Fixed (pending release) 14.3.3, 5.0.2 |
| js-yaml (front matter parsing) | Excessive processing time on crafted YAML | Fixed (pending release) 4.3.2 |
| DOMPurify (HTML sanitization) | Bypass in an option SetFN does not use | Fixed (pending release) 3.4.17 |
| @xmldom/xmldom (video playback support) | XML parsing defect | Fixed (pending release) 0.8.15 |
| TinyMCE 6 (mail editor) | Crafted HTML could execute scripts (4 issues are fixed only in 7.x) | Fixed (pending release) TinyMCE removed. The bulk notice mail editor was replaced with Tiptap (2026-10-24) |
| TinyMCE 6 (HTML file editor) | Same as above | Fixed (pending release) TinyMCE removed. HTML files are edited as source code only (2026-10-24) |
External document processing programs
Reviewed: 2026-10-23. Vulnerabilities rated High or above (CVSS 7.0+) since 2025 in the programs SetFN calls for previews, conversion, and character recognition, and their fix status on Ubuntu 24.04 LTS.
| Program | High or above since 2025 | Fix path on Ubuntu 24.04 | SetFN measures | Status |
|---|---|---|---|---|
| LibreOffice | 7 | main package, 1 unfixed (CVE-2026-63277) | Creates a fresh profile for every conversion and disables macros, external link updates, and Java | Fixed (pending release) Java blocking added, Operator action required package update |
| MuPDF | 5 | universe, unfixed (CVE-2026-3308) | Not used when Poppler is present. Installation is discouraged | Operator action required |
| libvips | 12 | universe, fixes only with Ubuntu Pro | Input size and pixel count limits, time limit | Operator action required |
| ImageMagick | 90 | universe, fixes only with Ubuntu Pro | Used only if installed | Operator action required |
| FFmpeg | About 53 | universe, fixes only with Ubuntu Pro | Used only for video thumbnails, allowed protocols restricted | Operator action required |
| Tesseract | 6 | universe, fixes only with Ubuntu Pro | Users cannot replace the OCR model files | Operator action required |
| Poppler | 2 | main, fixed | - | Operator action required package update |
| libheif, libde265 | 23 | main, mostly fixed | Input size limit | Operator action required package update |
| Pandoc | 0 | - | - | Not applicable |
| SQLite | 7 | main, fixed | The SetFN server embeds SQLite in the program, so the system package does not affect it | Not applicable |
What operators need to do is summarized in Checking Server Security Updates.
Cross-check against KISA security notices
Reviewed: 2026-10-23. All 463 security notices posted on KISA (KrCERT/CC) from 2025-01-01 to 2026-10-22 were checked.
- Notices that directly affect the SetFN product: 0
- Notices that apply depending on the operating environment: 32
- Not applicable: 431
The notices that apply depending on the operating environment are as follows.
| Component | Notices | Representative notice | Status |
|---|---|---|---|
| Linux kernel | 16 | Privilege escalation and memory corruption (CVE-2025-21756, CVE-2026-31431, and others) | Operator action required |
| sudo | 1 | Local privilege escalation (CVE-2025-32463) | Operator action required |
| OpenSSL | 2 | Buffer overflow and insufficient integrity verification (CVE-2025-15467, CVE-2026-34182, and others) | Operator action required The SetFN server program does not use the system OpenSSL |
| snapd | 2 | Privilege escalation (CVE-2026-3888, CVE-2026-8933) | Operator action required |
| GRUB2 | 1 | Bootloader memory corruption (CVE-2025-0678 and others) | Operator action required |
| FFmpeg | 1 | Out-of-bounds write (CVE-2026-8461) | Operator action required |
| FreeType | 1 | Out-of-bounds write (CVE-2025-27363) | Operator action required |
| Docker | 3 | Engine authentication bypass (CVE-2026-34040) and others | Operator action required When running with Docker |
| Ollama | 1 | Out-of-bounds read (CVE-2026-7482) | Operator action required When using local AI |
| nginx and other web servers | 4 | Heap overflow, excessive HTTP/2 memory allocation (CVE-2026-49975) | Operator action required When using a reverse proxy |
The HTTP/2 denial-of-service notice (CVE-2025-8671, MadeYouReset) was classified as Not applicable because the official Go announcement confirmed that Go is not affected.
Self-assessment against security standards
Reviewed: 2026-10-23, updated 2026-10-24. 37 items were verified in the code against OWASP Top 10:2025, OWASP ASVS 5.0, NIST SP 800-63B-4, and the KISA web vulnerability checklist. 20 items are compliant, 11 partially compliant, 5 need improvement, and 1 is not applicable.
| Item | Standard | Status |
|---|---|---|
| Server connection time limits (against slow connection attacks) | OWASP A02, KISA denial of service | Fixed (pending release) |
| Security response headers (clickjacking protection, MIME sniffing prevention, Referrer-Policy, Permissions-Policy) | ASVS web frontend | Fixed (pending release) |
| Enforcing HTTPS (HSTS) | ASVS secure communication, KISA plaintext data transmission | Operator action required Enabled on the reverse proxy that handles HTTPS, so that access is not blocked in environments with self-signed certificates |
| Blocking common and breached passwords | NIST SP 800-63B-4 | Fixed (pending release) |
| Length-based policy instead of password composition rules | NIST SP 800-63B-4 | Fixed (pending release) Default for new installations (at least 12 characters, no composition requirements). Existing servers keep their current rules |
| Server-side enforcement of the password policy | NIST SP 800-63B-4, ASVS authentication | Planned improvement |
| Two-factor authentication for administrators (OTP and others) | NIST SP 800-63B-4, ASVS authentication | Fixed (pending release) Authenticator app (TOTP) with recovery codes and a required policy |
| Audit records for changes to administrator security settings | OWASP A09, ASVS logging | Fixed (pending release) |
Items already confirmed as compliant include CSRF protection, sign-in attempt limits and blocking, expiry and single use of password reset codes, session invalidation on password change and sign-out, a fixed token signing algorithm, hiding internal details in error responses, and isolation of uploaded files.