Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

CVE-2026-19264: Postiz Social Media Scheduling Tool Allows Unauthorized Access

CVE-2026-19264 CVE-2026-19264
Summary

An attacker can access sensitive files on the server and use this information to take control of the Postiz instance without a password. This is a serious risk because it could allow unauthorized access to sensitive data and disrupt the normal operation of the service. To fix this, the Postiz developers should update the code to properly validate and restrict file access.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versions
gitroomhq postiz-app < 2.22.1
Original title
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising...
Original description
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password.
mitre CVSS3.1 9.8
Vulnerability type
CWE-22 Path Traversal
Published: 7 Aug 2026 · Updated: 7 Aug 2026 · First seen: 7 Aug 2026