服务器部署的 Umami 居然中招了最近 React 新爆出来的 CVE-2025-66478，放了个 /tmp/nginx3 运行起来

服务器部署的 Umami 居然中招了最近 React 新爆出来的 CVE-2025-66478，放了个 /tmp/nginx3 运行起来。好在是非特权容器化部署没什么权限，腾讯云也及时报警了。

立刻更新 Umami，而且官方还闹了个乌龙，把自己测试环境的 .env 文件打包到镜像里。一部署连得是对方的数据库，打开数据一片空白吓死人

GitHub

No data is loading for mysql-v2.20 version · Issue #3845 · umami-software/umami

Describe the Bug I upgraded to the latest mysql v2.20 version, no data is showing Database MySQL Relevant log output Which Umami version are you using? (if relevant) 2.20 Which browser are you usin...