This vulnerability arises from the POST /public/v1/upload-from-url endpoint in the Postiz AI social media scheduling tool. The server fetches the requested URL with axios.get() without any SSRF protection other than a trivial file extension filter. By appending an allowable image extension to any URL, an attacker can cause the server to retrieve arbitrary internal resources, access cloud instance metadata, and reach other internal services. The retrieved content is then stored and returned to the attacker, leading to potential information disclosure of internal network data and cloud configuration. The weakness corresponds to CWE‑918 and results in a compromise of confidentiality and possibly availability of the internal environment.

The product affected is the Postiz application from GitRoomhq (gitroomhq:postiz-app). Vulnerable versions are all releases prior to v2.21.3; a patch was issued in v2.21.3 to eliminate the SSRF flaw.

With a CVSS score of 8.3, the vulnerability is rated high severity. The EPSS score is below 1%, indicating a low current exploitation probability, yet the potential impact remains significant. The issue is not listed in CISA’s KEV catalog. The likely attack vector involves an authenticated API user sending a crafted URL to the upload-from-url endpoint. The absence of additional safeguards means that exploitation requires only the ability to authenticate and send a request to the vulnerable endpoint.