Postiz Arbitrary File Read via Crafted Media Path

Postiz contains an arbitrary file read vulnerability in its post publishing flow. When a post is published, a media path that is not a web address is treated as a file on the server's disk, without checking that the file lies inside the upload directory.

A registered user can store a crafted media path with a post, bypass the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.

The same unconfined reads can be reached through two further routes:

• One route tells the caller whether a file exists and can exhaust the backend's memory.
• The other delivers the file the same way as the main route.

Self-registration is open by default, so the attacker needs no existing account.