← Vulnerability feed

Vulnerability record · CVE-2026-42298 · published 8 May 2026

CVE-2026-42298: Gitroom postiz code injection vulnerability

Gitroom · Postiz

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.

9.8 CVSS 3.1 Critical EPSS 0.81% · top 44.7% CWE-94 · Code injection
9.8CVSS 3.1 base score
0.81%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
24 Jul 2026Last modified by NVD

Description

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/gitroomhq/postiz-app/commit/da448012dd87e94944cbe83a38e7fd023269ec46 URL Repurposed
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v975-9h5p-xhm4 Vendor Advisory

Track CVE-2026-42298 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.0CVE-2026-42556Gitroom postiz cross-site scripting vulnerabilityPostiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store ar…EPSS 0.44%9.0CVE-2026-40487Gitroom postiz cross-site scripting vulnerabilityPostiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitr…EPSS 0.26%8.6CVE-2026-34577Gitroom postiz server-side request forgery (ssrf) vulnerabilityPostiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied ur…EPSS 0.53%8.3CVE-2026-34576Gitroom postiz server-side request forgery (ssrf) vulnerabilityPostiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and f…EPSS 0.37%8.2CVE-2026-40168Gitroom postiz server-side request forgery (ssrf) vulnerabilityPostiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application valida…EPSS 0.52%5.4CVE-2026-34590Gitroom postiz server-side request forgery (ssrf) vulnerabilityPostiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which vali…EPSS 0.33%8.8CVE-2026-65660Microsoft sharepoint server code injection vulnerabilityImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.KEVEPSS 2.1%9.8CVE-2026-60004Gitea diffpatch API code injection enables remote code executionGitea before 1.27.1 allows remote code execution through the diffpatch API by way of Git hook installation. The flaw is a code injection issue (CWE-9…KEVEPSS 24%analysed

Source: NIST National Vulnerability Database (record CVE-2026-42298), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.