Postiz Arbitrary File Read and Denial-of-Service Vulnerability

Postiz has an unrestricted backend function invocation vulnerability that lets a signed-in user trigger internal helpers through their connected channels.

The backend failed to restrict which functions could be requested, exposing helper functions never meant to be reachable from the web interface. One helper reads files from the server's disk: by connecting a channel whose stored token is a file path, a user can retrieve any file the server can read, including its environment, which holds the login session signing secret, the database address, and credentials of connected services.

Another exposed helper makes the backend process exit with a single request.

• Impact: arbitrary file disclosure and denial of service.
• Precondition: signed-in user with a connected channel whose stored token is a file path.
• Self-registration is open by default, so no existing account or action by another user is required.