[MEDIUM] Public-facing file upload endpoints have no size limits #27

New issue

Open

opened 2026-05-05 15:44:48 -05:00 by pjennings · 0 comments

pjennings commented

2026-05-05 15:44:48 -05:00

Owner

Labels: area:security, area:network, priority:medium, type:enhancement

Description

In hosts/rp1.nix, multiple public-facing services have client_max_body_size 0 (unlimited):

photos.reinitialized.me (Immich)
docs.reinitialized.me (Paperless-ngx)
cloud.reinitialized.net (ownCloud OCIS)

Impact

Denial of service through extremely large uploads consuming disk space and bandwidth. An attacker could fill the data disk, causing service outages.

Recommended Fix

Set reasonable upload limits:

photos.reinitialized.me: 50GB (large photo/video uploads)
docs.reinitialized.me: 5GB (document uploads)
cloud.reinitialized.net: 10GB (cloud storage)
Keep proxy_request_buffering off for performance.

**Labels:** area:security, area:network, priority:medium, type:enhancement ## Description In hosts/rp1.nix, multiple public-facing services have client_max_body_size 0 (unlimited): - photos.reinitialized.me (Immich) - docs.reinitialized.me (Paperless-ngx) - cloud.reinitialized.net (ownCloud OCIS) ## Impact Denial of service through extremely large uploads consuming disk space and bandwidth. An attacker could fill the data disk, causing service outages. ## Recommended Fix Set reasonable upload limits: - photos.reinitialized.me: 50GB (large photo/video uploads) - docs.reinitialized.me: 5GB (document uploads) - cloud.reinitialized.net: 10GB (cloud storage) Keep proxy_request_buffering off for performance.