The vulnerability in postiz-app arises from improper neutralization of input during web page generation (CWE-79). Specifically, any authenticated user who can create a post can store arbitrary HTML by tampering with their save request. The stored HTML is rendered on the public preview page (/p/<postId>?share=true) using dangerouslySetInnerHTML on the main application origin, leading to cross-site scripting. This affects versions from 2.21.6 to before 2.21.7. The vulnerability has been patched in version 2.21.7.

Successful exploitation allows an authenticated user to inject arbitrary HTML and potentially malicious scripts into the post content, which are then executed in the context of the application origin when other users view the public preview link. This can lead to compromise of confidentiality and integrity of user data (high impact), and limited availability impact. The CVSS v3.1 score is 8.9 (high severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and scope change.

This vulnerability has been patched in postiz-app version 2.21.7. Users and administrators should upgrade to version 2.21.7 or later to remediate this issue. No additional mitigation actions are specified or required beyond applying the official fix.