Path Traversal Vulnerability in Postiz by Gitroom
CVE-2026-19264

9.3CRITICAL

Key Information:

Vendor

Gitroomhq

Status
Postiz-app
Vendor
CVE Published:
7 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-19264?

Postiz, an open-source social media scheduling tool developed by Gitroom, has a vulnerability that allows unauthenticated remote attackers to exploit the file handling mechanism. The application's upload route improperly manages URL paths, permitting attackers to access any file the application process can read, including sensitive configuration files. This vulnerability potentially exposes secrets like the JWT signing key, database credentials, and connected provider information. The flaw arises from deficiencies in path normalization, allowing attackers to craft URLs that traverse the file system and access sensitive data without authentication, enabling the creation of non-expiring administrative sessions.

Affected Version(s)

postiz-app 0 < 2.22.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-19264
Created by DarkLycn1976

References

https://github.com/gitroomhq/postiz-app/commit/7936062
patch
https://github.com/gitroomhq/postiz-app/releases/tag/v2.22.1
release-notes
https://gadvisory.org/advisories/PSA-2026-TH12B7
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

KRITHIK BABU P
Enno Gelhaus
Nevo David
.