The vulnerability is a path‑traversal flaw in Postiz’s media handling that lets a registered user supply a crafted media path which the publishing worker interprets as a server file path. The worker then reads the file from the disk and sends it as an attachment to a Discord server controlled by the user. Two additional routes expose the same ability: one reveals whether a file exists, potentially exhausting backend memory, and the other delivers the file directly. Consequently an attacker can read arbitrary files on the server, compromising confidentiality and potentially exposing sensitive information.

The affected product is GitroomHQ’s Postiz application. All releases prior to 2.25.3 contain the flaw; the patch was applied in release 2.25.3, as referenced by the commit and release tag in the advisory. Users running 2.25.2 or earlier are vulnerable.

The flaw carries a CVSS score of 9.6, indicating a high‑severity exposure. EPSS data is not available, but the absence from the CISA KEV list does not mitigate the risk. The likely attack vector is via self‑registration, which is enabled by default; an attacker can create a new account, craft a malicious post, and trigger the vulnerable worker. A workaround exists—disabling self‑registration or removing Discord provider credentials limits reach but does not fully eliminate the underlying flaw. Until a patched version is deployed, the vulnerability remains exploitable by any user with access to the web interface.