The vulnerability is a path‑traversal flaw with no authentication required. The route that reads media files concatenates user‑supplied path components directly onto the upload directory and streams the file without normalising the final path. URL‑encoded separators survive until the handler decodes them, allowing an attacker to resolve directory traversal indicators to arbitrary file locations on the filesystem, including configuration and environment files. By reading these files, the attacker obtains the JWT signing secret, database connection string, and other provider and billing secrets. Because session tokens are signed with that secret and lack an expiry claim, the attacker can forge tokens that grant arbitrary user privileges, including administrative access, effectively taking over the instance.

The affected product is GitroomHQ’s Postiz‑app, an open‑source social media scheduling tool. Vulnerable releases are those prior to the 2.22.1 release, which contains a fix that normalises file paths and restricts access to the upload directory only. No specific older version numbers are listed, so any deployment with a version older than or equal to 2.22.0 is at risk unless the patch has been manually applied.

With a CVSS score of 9.3 the vulnerability is considered critical. The exploit requires only the ability to send a crafted HTTP request to the /uploads route over the network, and authentication is not required. As the EPSS score is not available and the issue is not listed in the CISA KEV catalog, there is currently no public evidence of widespread exploitation, but the simplicity of the attack vector and the high impact make it a priority target for attackers. The lack of an expiry on session tokens means that once the secret is exposed, immediate and uncontrolled access to all users, including administrators, is achieved.