From 1e650266ab458401314129029d512c3958bb66e5 Mon Sep 17 00:00:00 2001
From: OdinKral <odikral@portolancast.dev>
Date: Sat, 16 May 2026 11:48:46 -0400
Subject: [PATCH 1/5] fix: block path traversal in pattern name lookup (closes
 #2094)

Pattern names containing ".." could be used to escape the patterns
directory and read arbitrary files via filepath.Join. Guard added at
the top of getFromDB; i18n key pattern_invalid_name added to all
11 locale files; test cases cover all common traversal variants.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 internal/i18n/locales/de.json             |  1 +
 internal/i18n/locales/en.json             |  1 +
 internal/i18n/locales/es.json             |  1 +
 internal/i18n/locales/fa.json             |  1 +
 internal/i18n/locales/fr.json             |  1 +
 internal/i18n/locales/it.json             |  1 +
 internal/i18n/locales/ja.json             |  1 +
 internal/i18n/locales/pl.json             |  1 +
 internal/i18n/locales/pt-BR.json          |  1 +
 internal/i18n/locales/pt-PT.json          |  1 +
 internal/i18n/locales/zh.json             |  1 +
 internal/plugins/db/fsdb/patterns.go      |  4 ++++
 internal/plugins/db/fsdb/patterns_test.go | 18 ++++++++++++++++++
 13 files changed, 33 insertions(+)

diff --git a/internal/i18n/locales/de.json b/internal/i18n/locales/de.json
index 2b0e2ec7..caaea34d 100644
--- a/internal/i18n/locales/de.json
+++ b/internal/i18n/locales/de.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "Video-Metadaten ausgeben",
   "path_to_yaml_config": "Pfad zur YAML-Konfigurationsdatei",
   "pattern_not_found_list_available": "Pattern '%s' nicht gefunden. Führen Sie 'fabric -l' aus, um verfügbare Patterns anzuzeigen",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "Pattern '%s' nicht gefunden.\n\nKeine Patterns installiert! Um dies zu beheben:\n  • Führen Sie 'fabric --setup' aus, um Patterns zu konfigurieren und herunterzuladen\n  • Oder führen Sie 'fabric -U' aus, um Patterns direkt herunterzuladen/zu aktualisieren",
   "pattern_variables_help": "Werte für Mustervariablen, z.B. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Repository %s wird geklont (Pfad: %s)...\\n",
diff --git a/internal/i18n/locales/en.json b/internal/i18n/locales/en.json
index a357f8b0..63bf15f1 100644
--- a/internal/i18n/locales/en.json
+++ b/internal/i18n/locales/en.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "Output video metadata",
   "path_to_yaml_config": "Path to YAML config file",
   "pattern_not_found_list_available": "pattern '%s' not found. Run 'fabric -l' to see available patterns",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "pattern '%s' not found.\n\nNo patterns are installed! To fix this:\n  • Run 'fabric --setup' to configure and download patterns\n  • Or run 'fabric -U' to download/update patterns directly",
   "pattern_variables_help": "Values for pattern variables, e.g. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Cloning repository %s (path: %s)...\n",
diff --git a/internal/i18n/locales/es.json b/internal/i18n/locales/es.json
index b59cdc47..77625e0b 100644
--- a/internal/i18n/locales/es.json
+++ b/internal/i18n/locales/es.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "Salida de metadatos del video",
   "path_to_yaml_config": "Ruta al archivo de configuración YAML",
   "pattern_not_found_list_available": "patrón '%s' no encontrado. Ejecuta 'fabric -l' para ver los patrones disponibles",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "patrón '%s' no encontrado.\n\n¡No hay patrones instalados! Para solucionar esto:\n  • Ejecuta 'fabric --setup' para configurar y descargar patrones\n  • O ejecuta 'fabric -U' para descargar/actualizar patrones directamente",
   "pattern_variables_help": "Valores para variables de patrón, ej. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonando el repositorio %s (ruta: %s)...\\n",
diff --git a/internal/i18n/locales/fa.json b/internal/i18n/locales/fa.json
index adcd8c43..bdcc361e 100644
--- a/internal/i18n/locales/fa.json
+++ b/internal/i18n/locales/fa.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "نمایش فراداده ویدیو",
   "path_to_yaml_config": "مسیر فایل پیکربندی YAML",
   "pattern_not_found_list_available": "الگوی '%s' یافت نشد. برای مشاهده الگوهای موجود 'fabric -l' را اجرا کنید",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "الگوی '%s' یافت نشد.\n\nهیچ الگویی نصب نشده است! برای رفع این مشکل:\n  • 'fabric --setup' را برای پیکربندی و دانلود الگوها اجرا کنید\n  • یا 'fabric -U' را برای دانلود/به‌روزرسانی الگوها اجرا کنید",
   "pattern_variables_help": "مقادیر برای متغیرهای الگو، مثال: -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "در حال کلون کردن مخزن %s (مسیر: %s)...\\n",
diff --git a/internal/i18n/locales/fr.json b/internal/i18n/locales/fr.json
index 286f853a..edeba001 100644
--- a/internal/i18n/locales/fr.json
+++ b/internal/i18n/locales/fr.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "Afficher les métadonnées de la vidéo",
   "path_to_yaml_config": "Chemin vers le fichier de configuration YAML",
   "pattern_not_found_list_available": "modèle '%s' non trouvé. Exécutez 'fabric -l' pour voir les modèles disponibles",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "modèle '%s' non trouvé.\n\nAucun modèle n'est installé ! Pour résoudre ce problème :\n  • Exécutez 'fabric --setup' pour configurer et télécharger les modèles\n  • Ou exécutez 'fabric -U' pour télécharger/mettre à jour les modèles directement",
   "pattern_variables_help": "Valeurs pour les variables de motif, ex. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonage du dépôt %s (chemin : %s)...\\n",
diff --git a/internal/i18n/locales/it.json b/internal/i18n/locales/it.json
index a599c2a6..ef564160 100644
--- a/internal/i18n/locales/it.json
+++ b/internal/i18n/locales/it.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "Output metadati video",
   "path_to_yaml_config": "Percorso del file di configurazione YAML",
   "pattern_not_found_list_available": "pattern '%s' non trovato. Esegui 'fabric -l' per vedere i pattern disponibili",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "pattern '%s' non trovato.\n\nNessun pattern installato! Per risolvere:\n  • Esegui 'fabric --setup' per configurare e scaricare i pattern\n  • Oppure esegui 'fabric -U' per scaricare/aggiornare i pattern direttamente",
   "pattern_variables_help": "Valori per le variabili pattern, es. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonazione del repository %s (percorso: %s)...\\n",
diff --git a/internal/i18n/locales/ja.json b/internal/i18n/locales/ja.json
index a0bc7c99..51044a1c 100644
--- a/internal/i18n/locales/ja.json
+++ b/internal/i18n/locales/ja.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "動画メタデータを出力",
   "path_to_yaml_config": "YAML設定ファイルのパス",
   "pattern_not_found_list_available": "パターン '%s' が見つかりません。'fabric -l'で利用可能なパターンを確認してください",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "パターン '%s' が見つかりません。\n\nパターンがインストールされていません！解決するには:\n  • 'fabric --setup'を実行してパターンを設定・ダウンロード\n  • または'fabric -U'を実行してパターンをダウンロード/更新",
   "pattern_variables_help": "パターン変数の値、例：-v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "リポジトリ %s をクローン中 (パス: %s)...\\n",
diff --git a/internal/i18n/locales/pl.json b/internal/i18n/locales/pl.json
index 02c7c008..ecf4929f 100644
--- a/internal/i18n/locales/pl.json
+++ b/internal/i18n/locales/pl.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "Wyprowadź metadane wideo",
   "path_to_yaml_config": "Ścieżka do pliku konfiguracyjnego YAML",
   "pattern_not_found_list_available": "wzorzec '%s' nie został znaleziony. Uruchom 'fabric -l', aby zobaczyć dostępne wzorce",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "wzorzec '%s' nie został znaleziony.\n\nNie zainstalowano żadnych wzorców! Aby to naprawić:\n  • Uruchom 'fabric --setup', aby skonfigurować i pobrać wzorce\n  • Lub uruchom 'fabric -U', aby bezpośrednio pobrać/zaktualizować wzorce",
   "pattern_variables_help": "Wartości dla zmiennych wzorców, np. -v=#role:ekspert -v=#points:30",
   "patterns_cloning_repository": "Klonowanie repozytorium %s (ścieżka: %s)...\n",
diff --git a/internal/i18n/locales/pt-BR.json b/internal/i18n/locales/pt-BR.json
index b4681081..c29089f5 100644
--- a/internal/i18n/locales/pt-BR.json
+++ b/internal/i18n/locales/pt-BR.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "Exibir metadados do vídeo",
   "path_to_yaml_config": "Caminho para arquivo de configuração YAML",
   "pattern_not_found_list_available": "padrão '%s' não encontrado. Execute 'fabric -l' para ver os padrões disponíveis",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "padrão '%s' não encontrado.\n\nNenhum padrão instalado! Para resolver:\n  • Execute 'fabric --setup' para configurar e baixar padrões\n  • Ou execute 'fabric -U' para baixar/atualizar padrões diretamente",
   "pattern_variables_help": "Valores para variáveis do padrão, ex. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonando repositório %s (caminho: %s)...\\n",
diff --git a/internal/i18n/locales/pt-PT.json b/internal/i18n/locales/pt-PT.json
index e9089719..2828875b 100644
--- a/internal/i18n/locales/pt-PT.json
+++ b/internal/i18n/locales/pt-PT.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "Mostrar metadados do vídeo",
   "path_to_yaml_config": "Caminho para ficheiro de configuração YAML",
   "pattern_not_found_list_available": "padrão '%s' não encontrado. Execute 'fabric -l' para ver os padrões disponíveis",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "padrão '%s' não encontrado.\n\nNenhum padrão instalado! Para resolver:\n  • Execute 'fabric --setup' para configurar e descarregar padrões\n  • Ou execute 'fabric -U' para descarregar/atualizar padrões diretamente",
   "pattern_variables_help": "Valores para variáveis de padrão, ex. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "A clonar repositório %s (caminho: %s)...\\n",
diff --git a/internal/i18n/locales/zh.json b/internal/i18n/locales/zh.json
index b75c0563..27241f58 100644
--- a/internal/i18n/locales/zh.json
+++ b/internal/i18n/locales/zh.json
@@ -418,6 +418,7 @@
   "output_video_metadata": "输出视频元数据",
   "path_to_yaml_config": "YAML 配置文件路径",
   "pattern_not_found_list_available": "未找到模式 '%s'。运行 'fabric -l' 查看可用模式",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "未找到模式 '%s'。\n\n未安装任何模式！要解决此问题：\n  • 运行 'fabric --setup' 配置并下载模式\n  • 或运行 'fabric -U' 直接下载/更新模式",
   "pattern_variables_help": "模式变量的值，例如 -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "正在克隆仓库 %s（至路径：%s）...\\n",
diff --git a/internal/plugins/db/fsdb/patterns.go b/internal/plugins/db/fsdb/patterns.go
index af34f0d5..e58fff75 100644
--- a/internal/plugins/db/fsdb/patterns.go
+++ b/internal/plugins/db/fsdb/patterns.go
@@ -119,6 +119,10 @@ func (o *PatternsEntity) applyVariables(
 
 // retrieves a pattern from the database by name
 func (o *PatternsEntity) getFromDB(name string) (ret *Pattern, err error) {
+	if strings.Contains(name, "..") {
+		return nil, fmt.Errorf(i18n.T("pattern_invalid_name"), name)
+	}
+
 	// First check custom patterns directory if it exists
 	if o.CustomPatternsDir != "" {
 		customPatternPath := filepath.Join(o.CustomPatternsDir, name, o.SystemPatternFile)
diff --git a/internal/plugins/db/fsdb/patterns_test.go b/internal/plugins/db/fsdb/patterns_test.go
index 5fe3c67a..56d6363e 100644
--- a/internal/plugins/db/fsdb/patterns_test.go
+++ b/internal/plugins/db/fsdb/patterns_test.go
@@ -332,6 +332,24 @@ func TestPrintPattern(t *testing.T) {
 	})
 }
 
+func TestGetFromDB_PathTraversal(t *testing.T) {
+	entity, cleanup := setupTestPatternsEntity(t)
+	defer cleanup()
+
+	traversalNames := []string{
+		"../etc/passwd",
+		"../../secret",
+		"foo/../bar",
+		"..",
+		"valid/../../../etc/shadow",
+	}
+	for _, name := range traversalNames {
+		_, err := entity.GetRaw(name)
+		assert.Error(t, err, "expected error for traversal name: %q", name)
+		assert.Contains(t, err.Error(), "invalid pattern name", "wrong error for: %q", name)
+	}
+}
+
 func TestPatternsEntity_CustomPatternsEmpty(t *testing.T) {
 	// Test behavior when custom patterns directory is empty or doesn't exist
 	mainDir, err := os.MkdirTemp("", "test-main-patterns-*")

From 54347b5cf5c740d74c320479b33acf3e7ce6c6d4 Mon Sep 17 00:00:00 2001
From: Kayvan Sylvan <kayvan@sylvan.com>
Date: Tue, 28 Jul 2026 08:06:48 -0700
Subject: [PATCH 2/5] fix(i18n): translate pattern_invalid_name into all 10
 non-English locales

---
 internal/i18n/locales/de.json    | 2 +-
 internal/i18n/locales/es.json    | 2 +-
 internal/i18n/locales/fa.json    | 2 +-
 internal/i18n/locales/fr.json    | 2 +-
 internal/i18n/locales/it.json    | 2 +-
 internal/i18n/locales/ja.json    | 2 +-
 internal/i18n/locales/pl.json    | 2 +-
 internal/i18n/locales/pt-BR.json | 2 +-
 internal/i18n/locales/pt-PT.json | 2 +-
 internal/i18n/locales/zh.json    | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/internal/i18n/locales/de.json b/internal/i18n/locales/de.json
index caaea34d..d8bbb4e4 100644
--- a/internal/i18n/locales/de.json
+++ b/internal/i18n/locales/de.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "Video-Metadaten ausgeben",
   "path_to_yaml_config": "Pfad zur YAML-Konfigurationsdatei",
   "pattern_not_found_list_available": "Pattern '%s' nicht gefunden. Führen Sie 'fabric -l' aus, um verfügbare Patterns anzuzeigen",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "Ungültiger Pattern-Name: %q",
   "pattern_not_found_no_patterns": "Pattern '%s' nicht gefunden.\n\nKeine Patterns installiert! Um dies zu beheben:\n  • Führen Sie 'fabric --setup' aus, um Patterns zu konfigurieren und herunterzuladen\n  • Oder führen Sie 'fabric -U' aus, um Patterns direkt herunterzuladen/zu aktualisieren",
   "pattern_variables_help": "Werte für Mustervariablen, z.B. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Repository %s wird geklont (Pfad: %s)...\\n",
diff --git a/internal/i18n/locales/es.json b/internal/i18n/locales/es.json
index 77625e0b..481e07b2 100644
--- a/internal/i18n/locales/es.json
+++ b/internal/i18n/locales/es.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "Salida de metadatos del video",
   "path_to_yaml_config": "Ruta al archivo de configuración YAML",
   "pattern_not_found_list_available": "patrón '%s' no encontrado. Ejecuta 'fabric -l' para ver los patrones disponibles",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "nombre de patrón inválido: %q",
   "pattern_not_found_no_patterns": "patrón '%s' no encontrado.\n\n¡No hay patrones instalados! Para solucionar esto:\n  • Ejecuta 'fabric --setup' para configurar y descargar patrones\n  • O ejecuta 'fabric -U' para descargar/actualizar patrones directamente",
   "pattern_variables_help": "Valores para variables de patrón, ej. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonando el repositorio %s (ruta: %s)...\\n",
diff --git a/internal/i18n/locales/fa.json b/internal/i18n/locales/fa.json
index bdcc361e..b98deb4e 100644
--- a/internal/i18n/locales/fa.json
+++ b/internal/i18n/locales/fa.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "نمایش فراداده ویدیو",
   "path_to_yaml_config": "مسیر فایل پیکربندی YAML",
   "pattern_not_found_list_available": "الگوی '%s' یافت نشد. برای مشاهده الگوهای موجود 'fabric -l' را اجرا کنید",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "نام الگوی نامعتبر: %q",
   "pattern_not_found_no_patterns": "الگوی '%s' یافت نشد.\n\nهیچ الگویی نصب نشده است! برای رفع این مشکل:\n  • 'fabric --setup' را برای پیکربندی و دانلود الگوها اجرا کنید\n  • یا 'fabric -U' را برای دانلود/به‌روزرسانی الگوها اجرا کنید",
   "pattern_variables_help": "مقادیر برای متغیرهای الگو، مثال: -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "در حال کلون کردن مخزن %s (مسیر: %s)...\\n",
diff --git a/internal/i18n/locales/fr.json b/internal/i18n/locales/fr.json
index edeba001..0caff7d6 100644
--- a/internal/i18n/locales/fr.json
+++ b/internal/i18n/locales/fr.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "Afficher les métadonnées de la vidéo",
   "path_to_yaml_config": "Chemin vers le fichier de configuration YAML",
   "pattern_not_found_list_available": "modèle '%s' non trouvé. Exécutez 'fabric -l' pour voir les modèles disponibles",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "nom de modèle invalide : %q",
   "pattern_not_found_no_patterns": "modèle '%s' non trouvé.\n\nAucun modèle n'est installé ! Pour résoudre ce problème :\n  • Exécutez 'fabric --setup' pour configurer et télécharger les modèles\n  • Ou exécutez 'fabric -U' pour télécharger/mettre à jour les modèles directement",
   "pattern_variables_help": "Valeurs pour les variables de motif, ex. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonage du dépôt %s (chemin : %s)...\\n",
diff --git a/internal/i18n/locales/it.json b/internal/i18n/locales/it.json
index ef564160..49ef8738 100644
--- a/internal/i18n/locales/it.json
+++ b/internal/i18n/locales/it.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "Output metadati video",
   "path_to_yaml_config": "Percorso del file di configurazione YAML",
   "pattern_not_found_list_available": "pattern '%s' non trovato. Esegui 'fabric -l' per vedere i pattern disponibili",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "nome pattern non valido: %q",
   "pattern_not_found_no_patterns": "pattern '%s' non trovato.\n\nNessun pattern installato! Per risolvere:\n  • Esegui 'fabric --setup' per configurare e scaricare i pattern\n  • Oppure esegui 'fabric -U' per scaricare/aggiornare i pattern direttamente",
   "pattern_variables_help": "Valori per le variabili pattern, es. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonazione del repository %s (percorso: %s)...\\n",
diff --git a/internal/i18n/locales/ja.json b/internal/i18n/locales/ja.json
index 51044a1c..96631243 100644
--- a/internal/i18n/locales/ja.json
+++ b/internal/i18n/locales/ja.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "動画メタデータを出力",
   "path_to_yaml_config": "YAML設定ファイルのパス",
   "pattern_not_found_list_available": "パターン '%s' が見つかりません。'fabric -l'で利用可能なパターンを確認してください",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "無効なパターン名: %q",
   "pattern_not_found_no_patterns": "パターン '%s' が見つかりません。\n\nパターンがインストールされていません！解決するには:\n  • 'fabric --setup'を実行してパターンを設定・ダウンロード\n  • または'fabric -U'を実行してパターンをダウンロード/更新",
   "pattern_variables_help": "パターン変数の値、例：-v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "リポジトリ %s をクローン中 (パス: %s)...\\n",
diff --git a/internal/i18n/locales/pl.json b/internal/i18n/locales/pl.json
index ecf4929f..afa540f6 100644
--- a/internal/i18n/locales/pl.json
+++ b/internal/i18n/locales/pl.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "Wyprowadź metadane wideo",
   "path_to_yaml_config": "Ścieżka do pliku konfiguracyjnego YAML",
   "pattern_not_found_list_available": "wzorzec '%s' nie został znaleziony. Uruchom 'fabric -l', aby zobaczyć dostępne wzorce",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "nieprawidłowa nazwa wzorca: %q",
   "pattern_not_found_no_patterns": "wzorzec '%s' nie został znaleziony.\n\nNie zainstalowano żadnych wzorców! Aby to naprawić:\n  • Uruchom 'fabric --setup', aby skonfigurować i pobrać wzorce\n  • Lub uruchom 'fabric -U', aby bezpośrednio pobrać/zaktualizować wzorce",
   "pattern_variables_help": "Wartości dla zmiennych wzorców, np. -v=#role:ekspert -v=#points:30",
   "patterns_cloning_repository": "Klonowanie repozytorium %s (ścieżka: %s)...\n",
diff --git a/internal/i18n/locales/pt-BR.json b/internal/i18n/locales/pt-BR.json
index c29089f5..8c8a0890 100644
--- a/internal/i18n/locales/pt-BR.json
+++ b/internal/i18n/locales/pt-BR.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "Exibir metadados do vídeo",
   "path_to_yaml_config": "Caminho para arquivo de configuração YAML",
   "pattern_not_found_list_available": "padrão '%s' não encontrado. Execute 'fabric -l' para ver os padrões disponíveis",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "nome de padrão inválido: %q",
   "pattern_not_found_no_patterns": "padrão '%s' não encontrado.\n\nNenhum padrão instalado! Para resolver:\n  • Execute 'fabric --setup' para configurar e baixar padrões\n  • Ou execute 'fabric -U' para baixar/atualizar padrões diretamente",
   "pattern_variables_help": "Valores para variáveis do padrão, ex. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonando repositório %s (caminho: %s)...\\n",
diff --git a/internal/i18n/locales/pt-PT.json b/internal/i18n/locales/pt-PT.json
index 2828875b..cc96595a 100644
--- a/internal/i18n/locales/pt-PT.json
+++ b/internal/i18n/locales/pt-PT.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "Mostrar metadados do vídeo",
   "path_to_yaml_config": "Caminho para ficheiro de configuração YAML",
   "pattern_not_found_list_available": "padrão '%s' não encontrado. Execute 'fabric -l' para ver os padrões disponíveis",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "nome de padrão inválido: %q",
   "pattern_not_found_no_patterns": "padrão '%s' não encontrado.\n\nNenhum padrão instalado! Para resolver:\n  • Execute 'fabric --setup' para configurar e descarregar padrões\n  • Ou execute 'fabric -U' para descarregar/atualizar padrões diretamente",
   "pattern_variables_help": "Valores para variáveis de padrão, ex. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "A clonar repositório %s (caminho: %s)...\\n",
diff --git a/internal/i18n/locales/zh.json b/internal/i18n/locales/zh.json
index 27241f58..c767693a 100644
--- a/internal/i18n/locales/zh.json
+++ b/internal/i18n/locales/zh.json
@@ -418,7 +418,7 @@
   "output_video_metadata": "输出视频元数据",
   "path_to_yaml_config": "YAML 配置文件路径",
   "pattern_not_found_list_available": "未找到模式 '%s'。运行 'fabric -l' 查看可用模式",
-  "pattern_invalid_name": "invalid pattern name: %q",
+  "pattern_invalid_name": "无效的模式名称：%q",
   "pattern_not_found_no_patterns": "未找到模式 '%s'。\n\n未安装任何模式！要解决此问题：\n  • 运行 'fabric --setup' 配置并下载模式\n  • 或运行 'fabric -U' 直接下载/更新模式",
   "pattern_variables_help": "模式变量的值，例如 -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "正在克隆仓库 %s（至路径：%s）...\\n",

From e36a231f3f5e0d9861aaab6c6df97b08d2ecd6f9 Mon Sep 17 00:00:00 2001
From: Kayvan Sylvan <kayvan@sylvan.com>
Date: Tue, 28 Jul 2026 08:11:17 -0700
Subject: [PATCH 3/5] chore: incoming 2123 changelog entry

---
 cmd/generate_changelog/incoming/2123.txt | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 cmd/generate_changelog/incoming/2123.txt

diff --git a/cmd/generate_changelog/incoming/2123.txt b/cmd/generate_changelog/incoming/2123.txt
new file mode 100644
index 00000000..049792eb
--- /dev/null
+++ b/cmd/generate_changelog/incoming/2123.txt
@@ -0,0 +1,3 @@
+### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup
+
+- **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants.

From 37fc6686facc6b8743581e9de716dea58a340231 Mon Sep 17 00:00:00 2001
From: Kayvan Sylvan <kayvan@sylvan.com>
Date: Tue, 28 Jul 2026 08:15:07 -0700
Subject: [PATCH 4/5] docs: credit security fix contributors and note
 translations

- Credit both contributors for the path traversal security fix.
- Document new translations for the invalid pattern message.
---
 cmd/generate_changelog/incoming/2123.txt | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cmd/generate_changelog/incoming/2123.txt b/cmd/generate_changelog/incoming/2123.txt
index 049792eb..0a5760cb 100644
--- a/cmd/generate_changelog/incoming/2123.txt
+++ b/cmd/generate_changelog/incoming/2123.txt
@@ -1,3 +1,4 @@
-### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup
+### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [ksylvan](https://github.com/ksylvan) and [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup
 
 - **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants.
+- New translations for the "invalid pattern" user-facing string.

From 64b1fc1fab4db2b12a3cd1eefc6dd1087a256874 Mon Sep 17 00:00:00 2001
From: Kayvan Sylvan <kayvan@sylvan.com>
Date: Tue, 28 Jul 2026 08:24:41 -0700
Subject: [PATCH 5/5] chore: renumber incoming changelog entry 2123 -> 2167

---
 cmd/generate_changelog/incoming/{2123.txt => 2167.txt} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename cmd/generate_changelog/incoming/{2123.txt => 2167.txt} (100%)

diff --git a/cmd/generate_changelog/incoming/2123.txt b/cmd/generate_changelog/incoming/2167.txt
similarity index 100%
rename from cmd/generate_changelog/incoming/2123.txt
rename to cmd/generate_changelog/incoming/2167.txt