From 2e4d8ed661e9d53f7499c76fd26af318442a4f7d Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Tue, 31 Mar 2026 12:52:38 -0500
Subject: [PATCH] block filter and attach flags in custom ffmpeg export args

The ffmpeg argument blocklist missed -filter_complex, -lavfi, -vf,
-af, -filter, and -attach. These flags can read arbitrary files via
source filters like movie= and amovie=, bypassing the existing -i
block. A user with camera access could exploit this through the
custom export endpoint.
---
 frigate/record/export.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/frigate/record/export.py b/frigate/record/export.py
index 1c02fd1124..ddd14dfd6a 100644
--- a/frigate/record/export.py
+++ b/frigate/record/export.py
@@ -36,7 +36,9 @@ logger = logging.getLogger(__name__)
 DEFAULT_TIME_LAPSE_FFMPEG_ARGS = "-vf setpts=0.04*PTS -r 30"
 TIMELAPSE_DATA_INPUT_ARGS = "-an -skip_frame nokey"
 
-# ffmpeg flags that can read from or write to arbitrary files
+# ffmpeg flags that can read from or write to arbitrary files.
+# filter flags are blocked because source filters like movie= and
+# amovie= can read arbitrary files from the filesystem.
 BLOCKED_FFMPEG_ARGS = frozenset(
     {
         "-i",
@@ -45,6 +47,12 @@ BLOCKED_FFMPEG_ARGS = frozenset(
         "-passlogfile",
         "-sdp_file",
         "-dump_attachment",
+        "-filter_complex",
+        "-lavfi",
+        "-vf",
+        "-af",
+        "-filter",
+        "-attach",
     }
 )