Skip to content
OpenAdvisories

Vendor

gitroomhq

20 known vulnerabilities.

Products

postiz-app 20
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-19264 Public exploit

    Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

    Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route req…

    gitroomhq postiz-app
  • Critical 10.0
    CVE-2026-42298 Public exploit

    Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

    Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the…

    gitroomhq postiz-app
  • High 8.9
    CVE-2026-40487 Public exploit

    Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

    Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploade…

    gitroomhq postiz-app