Dispositioned Issues

A recursive directory listing loads every file entry in a subtree into memory at once and then makes a second full copy while turning it into JSON, with no limit on count or depth. A user with a large accessible tree can spike server memory and CPU, and repeat the call to exhaust resources.

When a user shares a folder with a public link, the access rules that normally block certain sub-folders or files stop being enforced. Anyone with the link can browse, download, or bulk-download items inside the shared folder that the owner had configured to be off-limits.

When on-disk preview caching is turned on, generated thumbnails are never cleaned up and an internal lock table keeps growing. Because the cache key includes a file's modification time, a user can force endless new cache entries by re-uploading, slowly filling the disk and memory.

Developer triage: auth hook is disabled in our deployments and the login endpoint sits behind an external rate limiter; judged not applicable.

When login is handled by an external hook program, every single login attempt starts a new copy of that program before any password is checked, and there is no time limit on how long it may run. A flood of login requests can pile up processes and exhaust the server.