- Affected version
- 2.3.7
When calling /api/media-category/{id}/content all photos for that category load; none of it is paginated, even if passing the page parameter.
For categories/albums with hundreds or thousands of images, this can be abused as a way to attack the server, as it generates enormous responses on request. Currently with just under a thousand photos, I can spike memory utilization to ~100MB+ per request.
For categories/albums with hundreds or thousands of images, this can be abused as a way to attack the server, as it generates enormous responses on request. Currently with just under a thousand photos, I can spike memory utilization to ~100MB+ per request.
Last edited:
