Description (*)

This pull request introduces an additional security mitigation related to CVE-2025-54236.

It was identified that the /media/customer_address/ directory may be publicly accessible, which could expose sensitive files and increase the risk of exploitation.

To reduce the attack surface, this change recommends restricting direct access to this directory at the web server level by adding the following configuration to nginx.conf

This mitigation provides a defense-in-depth layer and helps prevent unauthorized access to sensitive resources. It does not replace applying official security patches but complements them.

Related Pull Requests

N/A

Fixed Issues (if relevant)

https://sansec.io/research/sessionreaper

Manual testing scenarios (*)

Apply the Nginx configuration.
Reload or restart Nginx.
Attempt to access a file inside /media/customer_address/ via a browser or HTTP request.
Verify that access is denied.

Questions or comments

This change is intended as a security hardening measure.

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
• All automated tests passed successfully (all builds are green)

Resolved issues:

1. resolves [Issue] Nginx remediation for vulnerability CVE-2025-54236 #40764: Nginx remediation for vulnerability CVE-2025-54236