Postiz-app before version 2.21.6 contains a vulnerability where file upload validation can be bypassed by authenticated users spoofing the Content-Type header. This allows uploading of arbitrary HTML, SVG, or other executable file types. The server (nginx) serves these files with content types based on their extensions, such as text/html or image/svg+xml, enabling Stored Cross-Site Scripting (CWE-79). The vulnerability can result in session riding, account takeover, and full compromise of other users' accounts. The fix is included in version 2.21.6.

An authenticated attacker can upload malicious executable files that are served by the application with executable content types, enabling Stored XSS attacks. This can lead to session riding, account takeover, and potentially full compromise of other users' accounts. The CVSS v3.1 score is 8.9 (high), reflecting the network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality and integrity with low impact on availability.

Upgrade postiz-app to version 2.21.6 or later, which contains a fix for this vulnerability. Since the vendor advisory does not provide additional remediation details, applying the official update is the recommended action. Patch status is confirmed by the version information in the description. No alternative mitigations are indicated.