Postiz, an AI social media scheduling tool, contains a file upload validation bypass that allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types by spoofing the Content‑Type header. The server then serves those files with MIME types derived from the original extension (text/html, image/svg+xml), allowing Stored Cross‑Site Scripting within the application’s origin. This flaw can be exploited to ride user sessions, takeover accounts, and fully compromise other users' accounts.

The vendor affecting this vulnerability is GitRoom HQ’s Postiz application. All releases before version 2.21.6 are impacted, while version 2.21.6 and later contain the remediation.

The CVSS score of 8.9 indicates a high‑severity flaw. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated web user exploiting the file‑upload endpoint; once an attacker uploads a malicious file, it is served back and executed in privileged browser contexts. The combination of high severity, authenticated access requirement, and lack of detection pushes this vulnerability to high risk for any organization running vulnerable Postiz instances.