Critical

Unauthenticated Path Traversal in Postiz Media Route

IdentifiersCVE-2026-19264CWE-22· Improper Limitation of a Pathname…

CVE-2026-19264 is a critical path traversal vulnerability in Postiz, an open-source social media scheduling tool, affecting versions earlier than 2.22.1. The flaw is in the route that serves locally stored media: URL-supplied path segments are joined to the upload directory and streamed without proper path normalization or confinement to the intended directory. Although raw dot-segments are collapsed before routing, URL-encoded path separators survive route matching and are decoded in the handler, reintroducing traversal at the filesystem access stage. Because the route is accessible without authentication, a remote attacker can read arbitrary files that are readable by the application process. This can expose sensitive application data such as environment variables, database connection information, and secrets used for integrated providers and billing systems. Exposure of the JWT signing secret is especially severe because Postiz session tokens are signed with that secret and do not expire, enabling passwordless forgery of persistent sessions for arbitrary users, including administrators.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthenticated arbitrary file read within the permissions of the Postiz application process. This can disclose highly sensitive configuration and secret material, including the JWT signing secret, database credentials, and third-party integration secrets. Disclosure of the JWT signing secret enables attackers to forge valid non-expiring session tokens for any account, including administrative accounts, resulting in full account compromise and likely complete application compromise. Secondary impact can include unauthorized access to backend data stores, abuse of connected external services, and broader confidentiality and integrity loss across the deployment.

Mitigation

If you can’t patch tonight, do this now.

Until the patched release is deployed, restrict or disable unauthenticated access to the affected media-serving route. Apply compensating controls so that file requests are authenticated and, where possible, additionally limited by network access controls or reverse-proxy rules. Harden path handling by rejecting traversal patterns and ensuring canonical path checks remain within the intended media directory. Monitor for suspicious file access patterns and treat the instance as potentially compromised if sensitive secrets may have been exposed, with immediate secret rotation as a priority.

Remediation

Patch, then assume compromise.

Upgrade Postiz to version 2.22.1 or later, which includes the vendor fix referenced for this issue. The vulnerable media-serving logic should be corrected to canonicalize and validate requested paths before filesystem access, reject traversal attempts including encoded separator variants, and enforce strict confinement to the designated upload directory. Because exploitation may expose long-lived authentication and infrastructure secrets, rotate the JWT signing secret, invalidate existing sessions where operationally feasible, and rotate any exposed database, provider, and billing credentials.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

PostizPostizapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cvefeed high severityNews

Aug 7, 2026

CVE-2026-19264 - Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

A critical unauthenticated path traversal vulnerability in Postiz/postiz-app that allows arbitrary file read, exposure of secrets such as JWT signing keys and database credentials, and subsequent forging of non-expiring administrator sessions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4