Enno Gelhaus

**Name of the Vulnerable Software and Affected Versions** Postiz (affected versions not specified) **Description** An unauthenticated remote attacker can perform an arbitrary file read by exploiting a path traversal issue in the route that serves locally stored media. The application joins URL-supplied path segments to the upload directory and streams the file without normalizing the path or confining it to the directory. While raw dot-segments are collapsed before routing, URL-encoded separators survive route matching and are decoded at the handler, enabling traversal during the filesystem call. This allows access to any file readable by the application process, including the process environment, which exposes the database connection string, connected provider and billing secrets, and the JWT (JSON Web Token) signing secret. Since session tokens are signed with this secret and lack an expiry date, an attacker can forge a non-expiring session for any user, including administrators, without a password. The affected endpoint is '/uploads'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw in the billing and license activation subsystem enables remote, unauthenticated attackers to bypass payment authorization workflows. The issue stems from insufficient cryptographic validation or a lack of server-side state verification regarding promotional and lifetime-deal (LTD) redemption codes. This allows attackers to forge valid redemption tokens or replay single-use codes to activate the highest-tier paid subscriptions without completing a financial transaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.