Arbitrary file read in Postiz via unrestricted provider method calls
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
GitroomHQ postiz-app from 2.23.0 before 2.25.2 lets a signed-in user run internal helper functions that were never meant to be reachable from the web interface, because the backend does not restrict which methods can be requested (CWE-470). One helper reads files from the server disk, so a user who connects a channel whose stored token is a file path can read any file the backend can read, including its environment secrets. Another helper makes the backend process exit with a single request. Self-registration is open by default, so an attacker needs only their own account and no action by another user.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade GitroomHQ postiz-app to version 2.25.2 or later, the fixed version for the affected range from 2.23.0 before 2.25.2.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA postiz-app (GitroomHQ) Fixed in 2.25.2
Timeline
- 2026-10-23 Threatist record created from CVE-2026-115931
- 2026-10-24 Alias added: GHSA-h5r5-h782-vqvp
- 2026-10-24 1 new reference · CNA
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-11-02 CISA SSVC decision points changed
More gitroomhq vulnerabilities
- TI-2026-26825 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVSS 3.1HIGH 8.6
- TI-2026-28982 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CVSS 3.1HIGH 8.2
- TI-2026-29238 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVSS 3.1CRITICAL 9.0
- TI-2026-26824 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVSS 4.0HIGH 8.3
- TI-2026-26837 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVSS 3.1MEDIUM 5.4
- TI-2026-15715 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-115931 · CVE Program
- CVE-2026-115931 · NVD
- FIRST EPSS
- GHSA-h5r5-h782-vqvp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences