Loading story…
A critical vulnerability tracked as CVE-2026-19264 affects Postiz, the open-source social media scheduling platform, allowing unauthenticated attackers to read arbitrary files through the /uploads route by exploiting path traversal with URL-encoded separators. The flaw stems from unsafe joining of user-controlled path segments to the configured upload directory without proper normalization or confinement, enabling access to sensitive files available to the application process. The issue is rated CVSS 9.8 and is classified as CWE-22.
Exposure of environment files can reveal the JWT signing secret, database credentials, and third-party provider or billing secrets, creating a path to full instance compromise. Because Postiz uses signed session tokens with no expiry, attackers who obtain the JWT secret can forge persistent sessions for any account, including administrators, effectively taking over the instance. The vulnerability affects postiz-app versions earlier than 2.22.1; a fix was introduced in commit 7936062, which resolves file paths, verifies they remain inside the upload directory, and rejects out-of-scope requests.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for a critical unauthenticated path traversal vulnerability in Postiz was published, describing how arbitrary file read via the /uploads route could expose secrets and enable forged administrator sessions. The advisory references remediation in commit 7936062 and notes affected versions earlier than 2.22.1, with a patched release referenced as v2.22.1.
A GitHub commit in gitroomhq/postiz-app changed the upload-serving route to resolve paths and verify they remain within the configured upload directory, blocking traversal outside that directory. The commit was made by nevo-david and is associated in the source with release tag v2.23.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegadvisory.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in **Postiz** allows any authenticated user to escalate privileges to **SUPERADMIN** by forging JWTs through the application's **Skool integration callback**. Tracked as **`CVE-2026-48781`** and **`GHSA-j77w-h625-56q2`**, the flaw stems from attacker-controlled JSON being signed into a session-like token with the application's `JWT_SECRET`, while authentication logic trusted the token's claims without reloading the user record from the database. The bug affects Postiz versions prior to **`2.21.8`** and enables cross-tenant takeover, arbitrary organization impersonation, full access across the affected instance, exposure of all registered users, and the ability to post through victims' connected social media accounts. The issue is rated **CVSS 9.9 (Critical)**, was verified and patched by the vendor, and defenders are advised to upgrade to **`2.21.8`**, rotate JWT secrets if compromise is suspected, and review logs for impersonation or unauthorized access activity.
Jul 12, 2026
Postiz, an AI social media scheduling tool, patched two **server-side request forgery** vulnerabilities affecting its public stream functionality. `CVE-2026-34577` exposed an unauthenticated flaw in `GET /public/stream`, where a user-controlled `url` parameter could cause the server to fetch and return the full HTTP response to the requester. The endpoint relied on an extension check requiring the URL to end in `mp4`, but that validation could be trivially bypassed, enabling access to internal services, cloud metadata endpoints, and other internal network resources. The issue was fixed in version **2.21.3** and assigned **CWE-918**.
Jun 29, 2026
OpenBMB ChatDev through version **2.2.0** is affected by **`CVE-2026-58166`**, a critical unauthenticated path traversal flaw in its file upload handler that lets remote attackers write or delete arbitrary files on the server. The vulnerability stems from the `POST` uploads session endpoint, where a malicious multipart filename containing traversal sequences or an absolute path is passed into `save_upload_file` without proper sanitization, allowing attacker-controlled filesystem paths to be used during upload and cleanup operations. The issue is rated **CVSS 3.1 9.1 (Critical)**, with a listed **CVSS 4.0 8.8 (High)**, and is considered remotely exploitable without authentication. The flaw was fixed in commit **`4fd4da6`**, and affected organizations should update to a patched release and enforce strict validation and sanitization of upload filenames and paths to prevent arbitrary file write or deletion.
Jul 1, 2026