The vulnerability in Postiz’s build workflow permits an unauthenticated attacker to inject arbitrary code into the Docker build process by modifying Dockerfile.dev in a pull request. This results in the execution of attacker supplied commands during image construction and the exfiltration of a highly privileged GitHub token with write‑all permissions. Because the code runs with the privileges of the workflow, the attacker can compromise both confidentiality and integrity of the repository and any downstream services.

The affected product is Postiz‑app from gitroomhq. The issue exists in all releases that include the original .github/workflows/pr‑docker‑build.yml prior to the patch commit da44801. Any user who opens a pull request from a fork containing a malicious Dockerfile.dev can trigger the vulnerability.

The CVSS score of 10 indicates critical severity. No EPSS data is available, and the vulnerability is not yet listed in CISA’s KEV catalog, but the attack vector requires only an unauthenticated pull request, making exploitation straightforward. The attacker needs only to host a fork with a tampered Dockerfile.dev and submit a PR to trigger the workflow.