EUVD-2026-54488
GHSA-2p7p-3c9x-rwxm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network file read (PR:N/UI:N/AC:L); C:H directly, and I:H/A:H because the leaked JWT secret enables forging non-expiring admin sessions for full takeover.
Primary rating from Vendor (postiz).
CVSS VectorVendor: postiz
Lifecycle Timeline
6DescriptionCVE.org
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password.
AnalysisAI
Arbitrary file read in Postiz (gitroomhq/postiz-app before 2.22.1) lets an unauthenticated remote attacker retrieve any file readable by the application process via the /api/uploads media route, which fails to confine URL-supplied path segments to the upload directory. Because URL-encoded traversal sequences survive Next.js route matching and are decoded only at the filesystem call, an attacker can read the process environment to steal the JWT signing secret, then forge a non-expiring administrator session without a password - turning a file-disclosure bug into full account takeover. There is publicly available fix code (vendor commit and v2.22.1 release), but no public exploit identified at time of analysis and the issue is not in CISA KEV.
Technical ContextAI
The affected component is a Next.js catch-all API route (apps/frontend/src/app/(app)/api/uploads/[[...path]]/route.ts) that serves locally stored uploads by concatenating URL path segments onto process.env.UPLOAD_DIRECTORY and streaming the result. This is a classic CWE-22 improper limitation of a pathname to a restricted directory: the handler performed no canonicalization and no containment check. Next.js collapses raw dot-segments (../) during routing, but percent-encoded separators (e.g. %2e%2e%2f) pass through route matching intact and are URL-decoded only when they reach the handler, reconstituting the traversal at the filesystem read. The vendor fix imports Node's path.resolve and path.sep, resolves both the base and the requested path, and rejects any resolved path that is not the base or does not start with base+sep - so resolve() normalizes decoded '..' segments and the prefix check enforces confinement. The high blast radius comes from the deployment model: secrets (JWT signing key, database connection string, provider/billing credentials) live in the process environment, and JWT session tokens are signed with that key and carry no expiry.
RemediationAI
Vendor-released patch: upgrade to Postiz 2.22.1 or later, which adds path canonicalization and a base-directory containment check to the uploads route (fix commit https://github.com/gitroomhq/postiz-app/commit/7936062, release https://github.com/gitroomhq/postiz-app/releases/tag/v2.22.1, advisory https://gadvisory.org/advisories/PSA-2026-TH12B7). If you cannot upgrade immediately, place the /api/uploads endpoint behind an authenticating reverse proxy or WAF rule that rejects requests containing encoded traversal tokens (%2e, %2f, %5c and their double-encoded forms) - with the side effect that legitimate filenames containing those encodings will also be blocked. As a stronger compensating control, run the application process under a low-privilege account with a restrictive filesystem view (dedicated user, chroot/container with only the upload directory mounted) so an arbitrary read exposes as little as possible, and rotate all secrets that live in the process environment (JWT signing secret, database connection string, provider and billing credentials) since a successful read may have already exfiltrated them; note that rotating the JWT secret will invalidate existing sessions and force re-login.
More in Postiz App
View allPrivilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated us
Arbitrary code execution and privileged token theft affects Postiz (gitroomhq/postiz-app) prior to commit da44801 throug
Stored cross-site scripting in Postiz (gitroomhq/postiz-app) versions 2.21.6 through 2.21.6 lets any authenticated user
File upload validation bypass in Postiz social media scheduler (versions before 2.21.6) allows authenticated users to up
Server-side request forgery in Postiz AI social media scheduling tool (versions < 2.21.3) allows unauthenticated remote
Server-side request forgery (SSRF) in Postiz social media scheduling tool versions prior to 2.21.3 allows authenticated
Server-side request forgery in Postiz (gitroomhq postiz-app) versions prior to 2.21.5 allows unauthenticated remote atta
Business-logic authentication bypass in Postiz self-hosted AI social media scheduler (gitroomhq/postiz-app) before 2.21.
DNS rebinding exploits a TOCTOU flaw in Postiz v2.16.6-2.21.6 to bypass all SSRF protections added in v2.21.4-v2.21.6, a
Server-side request forgery (SSRF) in Postiz prior to version 2.21.4 allows authenticated users to create webhooks point
Unauthenticated exploitation of Postiz's `/public/modify-subscription` endpoint allowed any caller in possession of a va
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today