Postiz EUVD-2026-54488

Exploitation requires only that the Postiz instance (version <2.22.1) be network-reachable and that the /api/uploads media-serving route be exposed, which is its default behavior - the route requires no authentication and no user interaction. The specific enabling condition is that local media storage is used with UPLOAD_DIRECTORY configured (the default self-hosted setup), and the attacker must supply URL-encoded path separators rather than raw '..' because raw dot-segments are collapsed by routing before reaching the handler. Full account-takeover impact additionally depends on the deployment placing the JWT signing secret in the process environment (the standard configuration) and on the app issuing non-expiring tokens. Limiting factors: only files readable by the application process user are exposed, and organizations that terminate /api/uploads behind an authenticating proxy or run the app with a tightly scoped filesystem reduce the reachable data.

This is a genuine high priority, not an inflated CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description: network-reachable, low complexity, no authentication, no user interaction, and full confidentiality/integrity/availability impact once the JWT secret is stolen and admin sessions are forged. The confidentiality claim (arbitrary file read) is directly supported; the integrity and availability claims are a second-order consequence of secret disclosure enabling non-expiring admin session forgery, which the description explains plausibly. No EPSS score, SSVC decision, KEV listing, or POC was provided, so real-world exploitation volume is unquantified - treat the likelihood signals as missing rather than low. The path-traversal-to-secret-exfiltration pattern is highly automatable and the preconditions are minimal, so absence of a published POC should not lower urgency for internet-exposed instances.

An attacker locates an internet-exposed Postiz instance and requests the unauthenticated uploads route with a URL-encoded traversal payload (for example /api/uploads/..%2f..%2f..%2fproc/self/environ) to read the application process environment. They extract the JWT signing secret, mint a token for an administrator user ID, and because tokens carry no expiry, use it as a permanent admin session to take over the instance and its connected social/billing accounts. No public exploit is identified at time of analysis, but the low-complexity, no-auth vector makes weaponization trivial.