CVE-2026-19264

Name of the Vulnerable Software and Affected Versions Postiz (affected versions not specified)

Description An unauthenticated remote attacker can perform an arbitrary file read by exploiting a path traversal issue in the route that serves locally stored media. The application joins URL-supplied path segments to the upload directory and streams the file without normalizing the path or confining it to the directory. While raw dot-segments are collapsed before routing, URL-encoded separators survive route matching and are decoded at the handler, enabling traversal during the filesystem call. This allows access to any file readable by the application process, including the process environment, which exposes the database connection string, connected provider and billing secrets, and the JWT (JSON Web Token) signing secret. Since session tokens are signed with this secret and lack an expiry date, an attacker can forge a non-expiring session for any user, including administrators, without a password. The affected endpoint is '/uploads'.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.