Skip to content
OpenAdvisories

Vendor

gitroomhq

20 known vulnerabilities.

Products

postiz-app 20
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-19264 Public exploit

    Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

    Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route req…

    gitroomhq postiz-app
  • Critical 10.0
    CVE-2026-42298 Public exploit

    Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

    Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the…

    gitroomhq postiz-app