Vulnerabilities

TI-2025-01309 CVE-2025-1522 · GHSA-55cg-p3v8-2vr3

Server-side request forgery in PostHog

LOW 30

PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00641 Published 2025-04-23 No fix listed CWE-918

TI-2025-01308 CVE-2025-1521 · GHSA-8w5j-q5mj-5jpv

LOW 30

PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00667 Published 2025-04-23 No fix listed CWE-918

TI-2025-01307 CVE-2025-1520 · GHSA-v64v-fq96-c5wv

LOW 37

PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00469 Published 2025-04-23 No fix listed CWE-89

TI-2024-09007 CVE-2024-9710 · GHSA-jrwm-4975-3g9g

LOW 37

PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00677 Published 2024-11-22 No fix listed CWE-918

TI-2023-25229 CVE-2023-46746

LOW 22

PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host.

CVSS 3.1MEDIUM 4.8 Local Low privileges User interaction EPSS 0.00381 Published 2023-12-01 No fix listed CWE-918

TI-2023-15619 CVE-2023-32325 · GHSA-8775-5hwv-wr6v

LOW 28

PostHog-js is a library to interface with the PostHog analytics tool.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00429 Published 2023-05-26 Fixed in 1.57.2 CWE-79

TI-2022-00561 CVE-2022-0645 · GHSA-6xh2-f372-cf5m

LOW 29

Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00799 Published 2022-04-19 Fixed in 1.34.1 CWE-601