Recyclarr 8.7 Security Response: Treat Template Sources as a Write Boundary

Recyclarr is valuable because it automates quality-profile and custom-format configuration across Sonarr and Radarr. That same automation means template sources are a write boundary. When template handling can escape its intended path, the response is not just an update; it is an inventory of what the template system could read or overwrite.

Reader question: Can remote templates or config sync overwrite files or leak secrets? Practical answer: They should not be able to after the fixed release, but you still need to upgrade, inventory template providers, compare generated files, protect secrets, and run negative tests in an isolated directory.

Source

Identify every template provider, branch, pinned commit, and local override used by the stack.

Render

Generate into a disposable path first so unexpected writes do not touch production configuration.

Compare

Compare generated YAML and application changes before pushing to Sonarr or Radarr.

Sync

Take application backups and keep a rollback point before syncing profile changes.

The Short Version

• Upgrade Recyclarr to the fixed release line identified by the advisory before trusting template providers.
• A trusted repository is not the same as safe path handling; pin and review templates anyway.
• Generate into a disposable directory and compare output before writing production config.
• Do not include production API keys or secrets in traversal or negative tests.

Decision Matrix

Area	What to Check	Operational Standard
Version	Recyclarr release, container digest, config schema	Run a fixed release and document the tested version.
Providers	Remote template repositories, branches, commits, local templates	Pin and review template sources.
Writes	Config directory, generated YAML, app API writes	Only expected paths and application fields change.
Recovery	Pre-sync config snapshot and app backups	Rollback is available before profile changes reach users.

Define Exposure Before You Touch The Upgrade Button

Start by identifying every place Recyclarr is reachable. The most important split is not public versus private in a vague sense; it is who can open the service, which reverse proxies can reach it, whether container bridge networks expose it to adjacent services, and whether backup or diagnostic paths contain secrets.

Capture the current version, image digest or package source, bind address, proxy route, authentication mode, and the identities that can administer it. That snapshot gives you evidence for the incident notes and a rollback reference if the remediation fails.

• Record the exact running version and compare it to the fixed floor: 8.7.x or newer fixed release as verified before publication.
• List inbound paths: VPN, reverse proxy, direct LAN, container network, and any published port.
• Save a configuration backup, but treat it as sensitive because it may contain tokens, password hashes, API keys, or internal addresses.
• Stop public or guest-network access while the exposure decision is unresolved.

Patch, Isolate, Or Rebuild: Choose The Right Response

If there is no credible sign of access and the service was never reachable from untrusted networks, patching may be enough. If Recyclarr was exposed to the internet, a guest network, a shared LAN, or a compromised host, assume the problem is wider than the package version.

The clean response is staged: isolate first, patch second, rotate secrets third, then validate from a network that should fail. A successful dashboard login after an upgrade is useful, but it is not proof that the old path is closed or that previous access did not happen.

• Upgrade before running sync against production.
• Pin remote providers to reviewed commits or tags instead of floating branches when stability matters.
• Run a harmless traversal fixture only in an isolated lab path.
• Compare generated files and application diffs before applying them to Sonarr or Radarr.

Rotate What The Vulnerable Path Could Reach

Secret rotation should follow reachability, not wishful thinking. Rotate the application key itself, any upstream application keys it could proxy or read, reverse-proxy credentials, webhook tokens, automation tokens, and any password that appeared in clear text or recoverable form inside backups or logs.

Do not rotate only the account you personally use. In homelab stacks, service accounts are often more powerful than user accounts because they can read media libraries, update configuration, call APIs, or write post-processing commands.

• Invalidate active sessions where the application supports it.
• Rotate API keys in dependent applications and update integrations one at a time.
• Search proxy logs, app logs, diagnostic bundles, and backup archives for old tokens.
• Keep a dated rotation record so stale keys are not accidentally reintroduced from backups.

Rebuild When The Evidence Is Dirty

A rebuild is not punishment; it is how you remove uncertainty when logs are missing, file contents changed, unknown commands ran, or secrets were exposed. Rebuild from a known-clean image, restore only reviewed configuration, and reconnect dependencies after credentials have been replaced.

For containers, rebuilding means more than pulling the latest image. Recreate the container, verify bind mounts, compare persistent configuration against a known-good baseline, and remove temporary files, unknown scripts, and stale backups that could carry the compromise forward.

Validation Checklist

• Recyclarr reports the expected fixed version.
• Template providers and pinned revisions are documented.
• A disposable negative test cannot read or write outside the intended config root.
• Generated output differs only where expected.
• Sonarr and Radarr backups exist before sync and old API keys are not printed in logs.

What This Does Not Prove

A clean Recyclarr run does not prove a template repository is safe, that historical generated files were not altered, or that Sonarr/Radarr state matches your intent. It only verifies the tested version and test path.

Security, Privacy, Legal, And Recovery Boundaries

• Do not run path-traversal fixtures against production paths.
• Do not publish API keys, application URLs, profile names tied to private libraries, or full generated configuration if it exposes your environment.
• Use this for lawful personal media organization and quality-profile management only.
• Back up application databases before sync operations that can rewrite many profiles at once.

Publication-Day Rechecks

• Reopen the Recyclarr advisory and release tag before publication.
• Confirm the fixed floor and whether later 8.7.x or 8.8.x releases supersede the recommendation.
• Verify current template-provider behavior against upstream docs.

Related TechGeeks Resources

• Arr Apps Explained
• Update a Media Stack Safely
• Container Security for Normal Homelabs

References

• Recyclarr Advisory GHSA-9wh7-8wrf-9x8r
• Recyclarr 8.7.1 Release

Final Operational Standard

The standard is to treat configuration templates as code with write access. Pin sources, upgrade the parser, test containment, review diffs, and keep rollback close.