Summary

An unauthenticated path traversal vulnerability exists in jotty.page endpoint:

• GET /api/app-icons/[filename]

The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/.

Details

Vulnerable code path:

• app/api/app-icons/[filename]/route.ts

Behavior:

• Untrusted filename is consumed from route params.
• Filesystem path is built with:
  • path.join(process.cwd(), "data", "uploads", "app-icons", filename)
• File is read directly with fs.readFile(filepath).
• There is no canonicalization + base-directory boundary check.

As a result, encoded traversal sequences like ..%2F..%2F can escape the intended directory.

Impact

• Unauthenticated disclosure of user records and password hashes
• Unauthenticated disclosure of active session-token mappings
• Unrestricted file read