Critical Postiz Path Traversal Enables Arbitrary File Read and Admin Session Forgery

A critical vulnerability tracked as CVE-2026-19264 affects Postiz, the open-source social media scheduling platform, allowing unauthenticated attackers to read arbitrary files through the /uploads route by exploiting path traversal with URL-encoded separators. The flaw stems from unsafe joining of user-controlled path segments to the configured upload directory without proper normalization or confinement, enabling access to sensitive files available to the application process. The issue is rated CVSS 9.8 and is classified as CWE-22.

Exposure of environment files can reveal the JWT signing secret, database credentials, and third-party provider or billing secrets, creating a path to full instance compromise. Because Postiz uses signed session tokens with no expiry, attackers who obtain the JWT secret can forge persistent sessions for any account, including administrators, effectively taking over the instance. The vulnerability affects postiz-app versions earlier than 2.22.1; a fix was introduced in commit 7936062, which resolves file paths, verifies they remain inside the upload directory, and rejects out-of-scope requests.