Read the docs
TI-2026-15715 Aliases CVE-2026-19264GHSA-2p7p-3c9x-rwxm

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Priority MEDIUM 50CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01013 63rd percentileScored 2026-11-07
Fix Fixed postiz-app (gitroomhq): 2.22.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gitroomhqpostiz-appbefore 2.22.12.22.1Patch availableCNA
  • postiz-app Vendorgitroomhq Affected before 2.22.1 Fixed in 2.22.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*——gitroomhq
  • cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:* Versions — — ·gitroomhq

Remediation

  • Fix · CNA postiz-app (gitroomhq) Fixed in 2.22.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19264
  2. 2026-10-03 Alias added: GHSA-2p7p-3c9x-rwxm

References

Patch 1

Advisory 1

Other 1

  • TI-2026-26825 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVSS 3.1HIGH 8.6
  • TI-2026-28982 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CVSS 3.1HIGH 8.2
  • TI-2026-29238 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVSS 3.1CRITICAL 9.0
  • TI-2026-26824 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVSS 4.0HIGH 8.3
  • TI-2026-26837 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVSS 3.1MEDIUM 5.4
  • TI-2026-30607 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev CVSS 3.1CRITICAL 10.0
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences