Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Summary

CVE	CVE-2026-19264
State	PUBLISHED
Assigner	postiz
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-08-07 15:17:00 UTC
Updated	2026-08-07 18:17:13 UTC
Description	Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password.

Risk And Classification

Primary CVSS: v4.0 9.3 CRITICAL from 4cdc9741-f887-419a-a2fd-acbbd2729276

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS: 0.006310000 probability, percentile 0.469010000 (date 2026-08-10)

Problem Types: CWE-22 | CWE-22 CWE-22

Version	Source	Type	Score	Severity	Vector
4.0	4cdc9741-f887-419a-a2fd-acbbd2729276	Secondary	9.3	CRITICAL	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C...`
4.0	CNA	CVSS	9.3	CRITICAL	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
3.1	4cdc9741-f887-419a-a2fd-acbbd2729276	Secondary	9.8	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	CNA	CVSS	9.8	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

CVSS v4.0 Breakdown

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Confidentiality

High

Integrity

High

Availability

High

Sub Conf.

None

Sub Integrity

None

Sub Availability

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Gitroomhq	Postiz-app	affected 2.22.1 semver	Not specified

References

Reference	Source	Link	Tags
gadvisory.org/advisories/PSA-2026-TH12B7	4cdc9741-f887-419a-a2fd-acbbd2729276	gadvisory.org
github.com/gitroomhq/postiz-app/releases/tag/v2.22.1	4cdc9741-f887-419a-a2fd-acbbd2729276	github.com
github.com/gitroomhq/postiz-app/commit/7936062	4cdc9741-f887-419a-a2fd-acbbd2729276	github.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: KRITHIK BABU P (en)

CNA: Enno Gelhaus (en)

CNA: Nevo David (en)

Additional Advisory Data

Source	Time	Event
CNA	2026-07-20T05:55:00.000Z	Postiz has received the advisory.
CNA	2026-07-20T07:44:00.000Z	Postiz has acknowledged and verified the advisory.
CNA	2026-07-20T12:18:00.000Z	Postiz has published a fix for this advisory, and verified that it works.
CNA	2026-08-07T14:13:00.000Z	Postiz has issued CVE-2026-19264 for this advisory.

There are currently no legacy QID mappings associated with this CVE.