A Server‑Side Request Forgery vulnerability in the Roadiz documents component allows an authenticated attacker to read arbitrary files on the server's local file system that the web server process can access. This can expose sensitive configuration data, database credentials, and environment variables, compromising confidentiality.

The vulnerability affects the Roadiz core bundle (core‑bundle‑dev‑app). Versions prior to 2.7.9, 2.6.28, 2.5.44, and 2.3.42 are vulnerable, while these patched releases eliminate the risk.

The CVSS score of 6.8 indicates medium severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with access to the document endpoint; once authenticated, the attacker can instruct the server to read any file within the web server’s privileges. The total impact is limited to files the web server process can read, as stated in the description. The likely attack vector is internal or externally authenticated users gaining access to the document functionality.