Path traversal in post media lets any registered user read server files

Overview

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.

The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.

Affected

• postiz-app >= 2.23.0 < 2.25.3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue. If you do not need the Discord provider, leave its client id, client secret and bot token unset. This removes the main route only; the other routes remain.