This vulnerability exists in the GET /public/stream endpoint of Postiz. The endpoint accepts a user‑supplied url query parameter and forwards the full HTTP response to the client. Validation only checks that the supplied URL ends with .mp4, a check that can be bypassed by appending .mp4 as a query value or fragment. Because the endpoint is publicly accessible and lacks SSRF protections, an unauthenticated attacker can retrieve responses from internal services, cloud metadata endpoints, and other network‑internal resources. The effect is a server‑side request forgery that exposes confidential internal network data, potentially allowing further attacks against the host or surrounding infrastructure.

Postiz, an AI social media scheduling application developed by GitRoomHQ. Versions earlier than 2.21.3 are affected.

The CVSS v3 score of 8.6 indicates high severity, reflecting the combination of unauthenticated access, high impact, and the ease of exploitation. Although EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, the no‑auth boundary and trivial bypass make it likely that threat actors could exploit it. Attackers can target the endpoint directly over HTTP/HTTPS; the condition is minimal – simply request the endpoint with a crafted url parameter. Successful exploitation yields read access to arbitrary internal HTTP(S) resources.