Roadiz, a polymorphic content‑management system, has an SSRF weakness (CWE‑918) in the documents component that allows an authenticated attacker to request any local file the web server process can access. The vulnerability can expose environment variables, database credentials, and other sensitive configuration files, resulting in a confidentiality breach.

Roadiz core-bundle-dev-app versions prior to 2.7.9, 2.6.28, 2.5.44, and 2.3.42 are affected. The patch was applied in these release versions, eliminating the flaw for newer installations.

The CVSS score of 6.8 indicates moderate severity. EPSS is less than 1 %, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and a crafted request to the vulnerable documents route. The likely attack vector appears to be internal to the application, not directly exposed to the network, as the description indicates only authenticated users can trigger the file read path.