Description

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-07T15:17:00.297Z",
  "pubdate": "2026-08-07T15:17:00.297Z",
  "executiveSummary": "Postiz contains an unauthenticated path traversal vulnerability affecting its local media serving route. The flaw stems from improper handling of URL-supplied path segments combined with the upload directory without path normalization or boundary confinement. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files accessible to the application process. This exposure includes sensitive environment variables such as the JWT signing secret, database connection strings, and connected provider and billing secrets. Because session tokens are signed with the exposed secret and carry no expiration, successful exploitation allows an attacker to forge non-expiring sessions for any user, including administrators, completely bypassing authentication mechanisms.",
  "technicalDetails": "The vulnerability resides in the Postiz route responsible for serving locally stored media files. The root cause of the issue is the direct concatenation of URL-supplied path segments onto the upload directory without prior path normalization or sandbox confinement. Furthermore, the route requires no authentication.\nDuring the routing process, raw dot-segments are collapsed before reaching the handler. However, URL-encoded path separators survive the initial route matching phase and are decoded only once they reach the file handler. This behavior restores the directory traversal sequence during the filesystem call, allowing the application to traverse outside the intended upload directory.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts an HTTP request targeting the vulnerable media-serving route containing URL-encoded traversal sequences. The routing mechanism accepts the path because raw dot-segments have been stripped or ignored during matching, and URL encoding bypasses early validation checks. Upon reaching the handler, the URL-encoded separators are decoded, transforming the path into a traversal payload (such as sequences traversing up to the root directory). The underlying filesystem operation then accesses and streams the requested file back to the attacker.\nThrough this attack vector, an attacker can read arbitrary files readable by the application process. Post-exploitation impact is severe because the leaked files include the process environment, exposing critical secrets including the JSON Web Token (JWT) signing secret, database connection strings, and third-party provider and billing secrets. Because session tokens lack an expiration mechanism and are cryptographically signed using the leaked JWT secret, the attacker can leverage the compromised secret to forge valid, non-expiring session tokens for any user account, including administrative roles, without requiring credentials."
}