CVE-2026-66066

This is a vulnerability affecting all OTW Archive forks. The original OTW Archive is currently vulnerable. Immediate action is required to protect user data and prevent potential system compromise.

Severity: CRITICAL (CVSS 9.5/10)
Vulnerability: Arbitrary File Read & Remote Code Execution
Affected: All OTW Archive forks using Rails 8.1.0 or earlier with Active Storage + libvips

Vulnerability Check

Relationship Symbol Key

One symbol goes between two character names in place of / or &. Pick the one that best describes the core nature of the bond. If you need more nuance, you can add a modifier symbol from the bottom of the table. Two symbols total, never more.

Examples: Alice ♥ Bob: romantic/sexual pairing Alice ♥→ Bob: one-sided romantic feelings (list the pursuer first)

Archive Warnings Update Guide

This guide goes over all files that need to be updated when modifying archive warnings, and how to deploy those changes to production.

(Line numbers are specific to fflol)

Files to Update

When adding, removing, or modifying archive warnings, you must update the following files:

1. Get yr site files ready

mkdir C:\sites\skaia-library

Drop yr index.html in there.

2. Install Caddy

Ruby Installation

Step 1: Download RubyInstaller

1. Go to rubyinstaller.org
2. Download Ruby+Devkit 3.4.6-1 (x64) (or latest stable 3.4.x version)
3. Run the installer

Step 2: Install Ruby

request_uri isn't quite the same as Apache's DOCUMENT_NAME, and it'll bite you eventually:

• DOCUMENT_NAME (Apache) = just the filename, no path, no query string. e.g. index.shtml
• $request_uri (nginx) = the full original URI including query string, e.g. /blog/post.html?utm_source=feed

So it'll work fine until something hits a URL with a ?... on it, or you reuse the include somewhere nested and want just the filename, not the whole path.

If you want a true filename-only equivalent, nginx doesn't expose one natively, but you can derive it with a map:

BookWyrm + Cloudflare Tunnel (updated)

If your Cloudflare tunnel points directly at Gunicorn (web:8000), nginx is bypassed entirely. Gunicorn returns HTML for every /static/ request, and the browser blocks it due to MIME type mismatch and that's why there's no CSS.

The fix is to point the tunnel at nginx instead, and disable certbot since Cloudflare handles TLS.

How the traffic flows

Without the fix (tunnel bypasses nginx):