Flare, a self‑hostable file sharing platform based on Next.js, contains a path traversal flaw in the /api/avatars/[filename] endpoint. The filename parameter is fed directly into path.join() without sanitization, and the subsequent getFileStream() call performs no path validation. This allows a logged‑in user to request specially crafted URLs containing percent‑encoded '../' sequences that escape the intended uploads/avatars/ directory and read any file readable by the Next.js process under the /app/ directory. The flaw, identified as CWE‑22, results in arbitrary file read and potential information disclosure within the container.

FlintSH’s Flare platform, specifically any release version before 1.7.3, is affected. Users running v1.7.2 or earlier, including the default distribution that enables open registration, are vulnerable. The issue is mitigated in the 1.7.3 release and later.

A high CVSS score of 8.3 indicates significant impact. Although the EPSS score is below 1% and the vulnerability is not listed in the CISA known exploited vulnerability catalog, based on the description it is inferred that the attack vector is straightforward: an attacker can either self‑register (when open registration is enabled) or use existing credentials to authenticate, then issue a request to the vulnerable endpoint with a crafted filename. This traversal yields arbitrary file reads and could expose sensitive configuration or code files, potentially leading to further compromise. Therefore, the risk is high, especially on publicly exposed instances.