Arbitrary code execution in Postiz pr-docker-build.yml workflow (CVE-2026-42298)

A "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (`.github/workflows/pr-docker-build.yml`) allows any unauthenticated attacker to execute arbitrary code during the Docker build process by submitting a pull request from a fork containing a maliciously modified `Dockerfile.dev`. Successful exploitation enables exfiltration of a highly privileged `GITHUB_TOKEN` with write-all permissions, granting the attacker full read-write access to the repository including the ability to commit code, create releases, and manage pull requests and issues. Affected versions: - >= 0 We recommend updating to: >= 0. CVSS 9.8 · our assessment: act_now Reference: https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v975-9h5p-xhm4 Details: https://vuln.today/cve/CVE-2026-42298