When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes.
One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
gitroomhq:postiz-app
References 4
https://gadvisory.org/advisories/PSA-2026-E9AHFV
4cdc9741-f887-419a-a2fd-acbbd2729276
https://github.com/gitroomhq/postiz-app
4cdc9741-f887-419a-a2fd-acbbd2729276
https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d7629…
4cdc9741-f887-419a-a2fd-acbbd2729276
https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3
4cdc9741-f887-419a-a2fd-acbbd2729276