Loading vulnerability…
Unauthenticated Path Traversal in Postiz Media Route
CVE-2026-19264 is a critical path traversal vulnerability in Postiz, an open-source social media scheduling tool, affecting versions earlier than 2.22.1. The flaw is in the route that serves locally stored media: URL-supplied path segments are joined to the upload directory and streamed without proper path normalization or confinement to the intended directory. Although raw dot-segments are collapsed before routing, URL-encoded path separators survive route matching and are decoded in the handler, reintroducing traversal at the filesystem access stage. Because the route is accessible without authentication, a remote attacker can read arbitrary files that are readable by the application process. This can expose sensitive application data such as environment variables, database connection information, and secrets used for integrated providers and billing systems. Exposure of the JWT signing secret is especially severe because Postiz session tokens are signed with that secret and do not expire, enabling passwordless forgery of persistent sessions for arbitrary users, including administrators.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated arbitrary file read within the permissions of the Postiz application process. This can disclose highly sensitive configuration and secret material, including the JWT signing secret, database credentials, and third-party integration secrets. Disclosure of the JWT signing secret enables attackers to forge valid non-expiring session tokens for any account, including administrative accounts, resulting in full account compromise and likely complete application compromise. Secondary impact can include unauthorized access to backend data stores, abuse of connected external services, and broader confidentiality and integrity loss across the deployment.
If you can’t patch tonight, do this now.
Until the patched release is deployed, restrict or disable unauthenticated access to the affected media-serving route. Apply compensating controls so that file requests are authenticated and, where possible, additionally limited by network access controls or reverse-proxy rules. Harden path handling by rejecting traversal patterns and ensuring canonical path checks remain within the intended media directory. Monitor for suspicious file access patterns and treat the instance as potentially compromised if sensitive secrets may have been exposed, with immediate secret rotation as a priority.
Patch, then assume compromise.
Upgrade Postiz to version 2.22.1 or later, which includes the vendor fix referenced for this issue. The vulnerable media-serving logic should be corrected to canonicalize and validate requested paths before filesystem access, reject traversal attempts including encoded separator variants, and enforce strict confinement to the designated upload directory. Because exploitation may expose long-lived authentication and infrastructure secrets, rotate the JWT signing secret, invalidate existing sessions where operationally feasible, and rotate any exposed database, provider, and billing credentials.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.