An unauthenticated path traversal vulnerability in Postiz-app allows remote attackers to access sensitive configuration files and forge administrative sessions.

The application fails to properly normalize file paths in a route serving local media, allowing an unauthenticated attacker to perform directory traversal. This grants access to the process environment, including JWT signing secrets and database credentials.

With a CVSS score of 9.8, this vulnerability allows for total system compromise. By stealing the JWT signing secret, an attacker can bypass all authentication mechanisms to gain full administrative control, leading to a complete breach of sensitive social media data and system configuration.

Immediate Action: Update gitroomhq postiz-app to version 2.22.1 or later immediately.

Proactive Monitoring: Review web server and application access logs for attempts to access non-media files or directory traversal patterns (e.g., ../ strings).

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing path traversal sequences directed at the media serving endpoints.

Public Exploit Available: Unknown

The ability to forge administrative sessions makes this a critical security event. All users of the Postiz application must apply the 2.22.1 update without delay to prevent unauthorized access and potential data exfiltration.