The postiz-app contains a directory traversal vulnerability in its media-serving route. The route concatenates URL-supplied path segments onto the upload directory path and streams files without properly normalizing or restricting the path to that directory. Although raw dot-segments are collapsed before routing, URL-encoded separators survive initial route matching and are decoded only in the handler, restoring the traversal capability at the filesystem call. This allows unauthenticated remote attackers to read any file readable by the application process, including sensitive secrets such as the JWT signing secret, database connection strings, and billing credentials. Because session tokens are signed with the exposed JWT secret and do not expire, attackers can forge valid, non-expiring sessions as any user, including administrators, without needing a password.

An unauthenticated remote attacker can read arbitrary files accessible by the application process, including highly sensitive secrets like JWT signing keys and database credentials. This exposure enables the attacker to forge valid session tokens that never expire, allowing full impersonation of any user, including administrators, without authentication. The vulnerability thus leads to complete compromise of the application’s authentication and potentially its data integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable route if possible, and monitor for suspicious activity. Avoid exposing the media-serving route without authentication. Consider implementing proper path normalization and confinement to the upload directory to prevent directory traversal.