Postiz: Arbitrary file read and backend crash via unrestricted provider calls
Summary
Postiz, an open-source social media scheduling tool, does not restrict which internal provider functions a signed-in user can call. A registered user can read any file the backend process can read, including its environment, which holds the JWT signing secret, database and Redis connection strings and connected-service credentials. A second helper function can terminate the backend with a single request. Self-registration is open by default, so an attacker needs only a self-registered account.
Affected
- GitroomHQ postiz-app 2.23.0 up to but not including 2.25.2 (per CNA record and GAdvisory)
- Default configuration is affected
Fixed in
- Fixed in v2.25.2 (commit 9383f5be)
- v2.25.3 or later is recommended by the research notes, which also fixes related advisories
Workaround
- Set DISABLE_REGISTRATION=true to close self-registration. This reduces exposure to people who already hold an account but does not fix the issue.
Exploitation
- The vendor and reporter demonstrated end-to-end exploitation with a self-registered account, reading a file and the JWT secret.
- Terminating the backend with one request was demonstrated separately.
- No exploitation in the wild has been reported. CISA KEV: not listed. No public PoC found.
Our recommendation
- Upgrade to v2.25.3 or later, not only 2.25.2.
- If a vulnerable version was exposed, rotate the JWT secret, database credentials and connected-service tokens, since a stolen signing secret allows forged sessions even after patching.
- Check logs for unusual access or unexpected backend restarts since 23 October 2026.
- Disable self-registration until the upgrade is verified.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GAdvisory PSA-2026-JNXM56 gadvisory.org
- Postiz release v2.25.2 github.com
- Postiz releases (v2.25.3) github.com
- Postiz fix commit 9383f5be github.com
- GitHub Security Advisory GHSA-wc9c-7cv8-m225 github.com
- Ostorlab write-up on CVE-2026-115931 blog.ostorlab.co
- VulDB entry 426049 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:55.
Original description (NVD)
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.