CVE-2026-19264
Received Received - Intake

Path Traversal in Postiz Media Streaming Route

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: 4cdc9741-f887-419a-a2fd-acbbd2729276

Description
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19264
EUVD
EUVD-2026-54488

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitroomhq postiz From 2.22.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in Postiz, an open-source social media scheduling tool. The application fails to properly normalize file paths when serving locally stored media. Attackers can exploit URL-encoded path separators to bypass security checks and access files outside the intended upload directory. This includes sensitive files like environment variables containing secrets such as JWT signing keys and database connection strings.

Detection Guidance

Check if Postiz is running and test the /uploads endpoint for path traversal by sending requests with URL-encoded path segments like ../etc/passwd or ..%2Fetc%2Fpasswd. Monitor for unauthorized file access or unusual requests to sensitive paths.

Impact Analysis

An unauthenticated attacker can read any file accessible to the application process, including configuration files and environment variables. This exposes critical secrets like JWT signing keys and database credentials. With the JWT secret, attackers can forge non-expiring session tokens for any user, including administrators, allowing full system takeover without a password.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA due to unauthorized access to sensitive data. Exposure of user data, credentials, and system configurations could result in data breaches, leading to regulatory penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Postiz to version 2.22.1 or later which includes the path normalization fix. If immediate upgrade is not possible, restrict access to the /uploads route and ensure sensitive files are not readable by the application process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart