Security Release

This release fixes vulnerabilities that let any logged-in user delete or read arbitrary files on the server and take over an admin session. All users should upgrade.

Security fixes

• File management (/file/**) is now limited to content managers. Before, any logged-in user could delete arbitrary files on the server through /file/removeFileFromDisk.
• /file/save no longer accepts file paths from the client. Before, any logged-in user could register any file on the server (including the H2 database) and download it through /file/serve.
• Remember-me cookies are no longer signed with a key that shipped with Streama. Each install now generates its own key on first start (streama-remember-me.key in the working directory). You can still set grails.plugin.springsecurity.rememberMe.key yourself.
• Users could read and change other users' viewing status (#1170).

After upgrading, everyone has to log in once more, because existing remember-me cookies were signed with the old key.

Docker users: rebuild your image, docker/Dockerfile downloads the latest release.

Credit: Hama1cco

Features

v1.11.1 was never published, so these ship with this release:

• Episode thumbnails in the player's episode selector
• Episode cards show the available audio and subtitle languages
• Subtitles are picked automatically based on the user's language
• FFmpeg audio transcoding for codecs browsers can't play (EAC3, AC3, DTS)
• Last login timestamp in user settings

Fixes

• Migrated from the deprecated OpenSubtitles.org API to the OpenSubtitles.com API v1

Changelog:

• Forgot password flow with 30-min token expiry
• Console fallback when email not configured
• OpenSubtitles API improvements

Security Release

This release patches CVE-2025-34452, a high-severity vulnerability in the
subtitle download functionality.

All users on versions 1.10.0 - 1.10.5 should upgrade immediately.

Security Fix

• Fixed SSRF and Path Traversal vulnerabilities in subtitle download (CVE-2025-34452)

Credit: Valentin Lobstein (Chocapikk)

• allow adding of genre to custom movies & tvShows #1054
• update default sorting on dashboard to be sort: 'first_air_date', order: 'DESC'
• fix: add supported platform for Apple M1 Silicon (thanks to bufgix)
• Add Slovak translation. (thanks to Jose Riha)

Log4j Security Release (CVE-2021-44228)

• Fixes #1097

Bugfixes

• allow GenericVideo to be Highlighted for "New Releases"
• fix Movie Image-Display in "New Releases" when images are Custom
• allow backdrop Uploading to manual Movies

New Features

• show item count for movies/tvShows/genericVideos/genre in admin area
• There is now a manage-Genre area, where you can view all Genres in your Database, including the ones from tmdb, as well as create & delete your own custom genre.

Bugfixes

• fix permission issue for marking videos as completed
• consolidate usages of poster_path, which fixes poster-bugs for watchlist
• fix watchlist rendering for empty videos
• fix genericMovie deleting

Add translatable content count to headers in dashboard

New Features

Random Episode Feature for TV Shows (thanks @ConflictingTheories)

Configurable in the settings:

Open subtitles integration (thanks @vsamofal)

Configurable in the settings:

Bugfixes

• Croatian translation (thanks @emanuelkufrin)
• #985 Exclude various non video related dependencies from tika (thanks @daknin)
• Added Turkish translation (thanks @panlazy)

• Feature: watched status #1003
• add option to hide dashboard search #971
• add customizable footer content #980
• fix Profile Genre saving