Critical Path Traversal in Postiz Exploited for Instance Takeover

CVE-2026-19264 is a critical path traversal vulnerability discovered in Postiz, an open-source social media management tool. The vulnerability originates from improper path sanitization in the application's file upload/retrieval mechanism. Due to a decoding-order mismatch between the Next.js routing layer and the application handler, attackers can use percent-encoded traversal sequences (such as %2e%2e%2f) to bypass route-level security controls. This allows unauthorized access to arbitrary files on the host filesystem.

By reading the server's .env configuration file, an unauthenticated attacker can obtain the JWT_SECRET used for session signing and the DATABASE_URL. Because session tokens in affected versions of Postiz lack expiration claims, the recovered secret allows for the forging of administrative tokens, providing the attacker with permanent and elevated access to the instance. This vulnerability affects Postiz installations using the local storage provider, which is the default configuration.

Attack Chain

1. The attacker probes the application to identify the /uploads/ endpoint, which is used for file retrieval.
2. The attacker crafts an HTTP GET request containing percent-encoded path traversal sequences (e.g., GET /uploads/..%2f..%2f..%2f.env).
3. The Next.js routing layer fails to filter the encoded sequences because it does not recognize them as directory separators, allowing the request to reach the application handler.
4. The application handler decodes the percent-encoded sequences into literal ../ segments, which are then concatenated with the UPLOAD_DIRECTORY path.
5. The application performs a file read via createReadStream() on the resulting path, successfully resolving to sensitive files outside the intended upload directory.
6. The attacker reads the contents of the .env file from the returned HTTP response body, extracting the JWT_SECRET and DATABASE_URL.
7. Using the JWT_SECRET, the attacker signs a forged administrative session token.
8. The attacker authenticates to the application using the forged token, achieving full instance takeover and administrative control over the platform.

Impact

Successful exploitation results in total system compromise. An attacker gains the ability to read any file readable by the application process, leading to the exfiltration of database credentials, OAuth secrets, and session signing keys. By forging session tokens, the attacker can impersonate any user, including administrators, without requiring prior authentication or user interaction. This vulnerability was verified as exploited in proof-of-concept form with a CVSS 3.1 score of 9.8.

Recommendation

Prioritize the following actions to secure vulnerable Postiz environments:

• Immediately upgrade Postiz instances to version 2.22.1 or later to remediate the path traversal vulnerability.
• Treat the JWT_SECRET as compromised on all affected versions; rotate this secret immediately to invalidate existing forged sessions.
• Rotate DATABASE_URL credentials and any linked OAuth provider keys that were exposed via the environment file.
• Implement the following detection logic to monitor for ongoing exploitation attempts targeting the file retrieval path.