CVE-2026-42298: fallo crítico en gitroomhq postiz-app
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 10epss 0.5%
Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
gitroomhq · postiz-appCVEs relacionadas — gitroomhq postiz-app
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-19264CRITICALUnauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeoverEPSS 1.0%CVE-2026-34577HIGHPostiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension CheckEPSS 0.5%CVE-2026-40168HIGHPostiz has Server-Side Request Forgery via Redirect Bypass in /api/public/streamEPSS 0.4%CVE-2025-53641HIGHPostiz allows header mutation in middleware facilitates resulting in SSRFEPSS 0.3%CVE-2026-34576HIGHPostiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadataEPSS 0.3%CVE-2026-42556HIGHPostiz stored XSS in public preview pageEPSS 0.3%