Vulnerability in Postiz AI Tool Allows Code Execution via Docker Build
CVE-2026-42298

10CRITICAL

Key Information:

Vendor

Gitroomhq

Status
Postiz-app
Vendor
CVE Published:
8 May 2026

What is CVE-2026-42298?

A vulnerability in the Postiz AI social media scheduling tool allows unauthenticated users to execute arbitrary code during the Docker build process. This is made possible through the Build and Publish PR Docker Image workflow, which can be exploited by submitting a Pull Request containing a maliciously modified Dockerfile.dev. The exploitation of this vulnerability can lead to the exfiltration of a highly privileged GITHUB_TOKEN with write-all permissions. The issue has been addressed in commit da44801.

Affected Version(s)

postiz-app < da448012dd87e94944cbe83a38e7fd023269ec46

References

https://github.com/gitroomhq/postiz-app/security/advisori...
x_refsource_CONFIRM
https://github.com/gitroomhq/postiz-app/commit/da448012dd...
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.