Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: GitroomHQ postiz-app 2.25.3 Clear all filters
TI-2026-80074 CVE-2026-115933 · GHSA-9j6f-8rw3-93c4

Forged signed tokens in Postiz let users take over other accounts

Priority MEDIUM 42

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00249 Published 2026-10-24 Fixed in 2.25.3 CWE-290
TI-2026-80073 CVE-2026-115932 · GHSA-rmc2-p2gv-m88f

Path traversal in Postiz lets registered users read server files

Priority MEDIUM 43

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00428 Published 2026-10-24 Fixed in 2.25.3 CWE-22