Postiz v2.25.3 Patches Critical Security Flaws

This is a must-install security release, not a feature update, with serious implications for teams running Postiz as an agent-accessible social publishing hub.

• –Path traversal enabled registered users to read arbitrary files, including environment files, logs, and session secrets.
• –Token forgery could enable password resets, account impersonation, API-key access, and organization takeover.
• –Open self-registration made exploitation relatively accessible on exposed instances.
• –Self-hosters should upgrade immediately and rotate potentially exposed credentials or signing secrets.