The postiz-app has a directory traversal vulnerability in a media-serving route that joins URL-supplied path segments onto the upload directory without proper normalization or confinement. Although raw dot-segments are collapsed, URL-encoded separators bypass route matching and are decoded only at the filesystem call, enabling traversal. This allows unauthenticated remote attackers to read any file readable by the application process, including secrets such as JWT signing keys and database credentials. The JWT tokens signed with the exposed secret lack expiration, enabling attackers to forge persistent sessions for any user, including administrators, without authentication.

An unauthenticated remote attacker can read arbitrary files on the server, exposing critical secrets such as JWT signing keys, database connection strings, and billing provider credentials. This leads to the ability to forge non-expiring session tokens for any user, including administrators, effectively allowing full account takeover without a password. The vulnerability compromises confidentiality, integrity, and availability of the application and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected route if possible and monitor for suspicious activity. Avoid exposing sensitive secrets in files accessible to the application process. Implement proper path normalization and confinement to prevent directory traversal. Consider adding expiration to JWT tokens to limit the impact of secret exposure.