CVE-2026-42298

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/gitroomhq/postiz-app/commit/da448012dd87e94944cbe83a38e7fd023269ec46	URL Repurposed
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v975-9h5p-xhm4	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-08 23:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-42298

Mitre link : CVE-2026-42298

CVE.ORG link : CVE-2026-42298

JSON object : View

Products Affected

gitroom

postiz

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-42298", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42298", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-11T17:58:43.572425Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gitroomhq", "product": "postiz-app", "versions": [{"status": "affected", "version": "< da448012dd87e94944cbe83a38e7fd023269ec46"}]}]}], "published": "2026-05-08T23:16:36.497", "references": [{"url": "https://github.com/gitroomhq/postiz-app/commit/da448012dd87e94944cbe83a38e7fd023269ec46", "tags": ["URL Repurposed"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v975-9h5p-xhm4", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Postiz is an AI social media scheduling tool. Prior to commit da44801, a \"Pwn Request\" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801."}, {"lang": "es", "value": "Postiz es una herramienta de programaci\u00f3n de redes sociales con IA. Antes del commit da44801, una vulnerabilidad 'Pwn Request' en el flujo de trabajo de compilaci\u00f3n y publicaci\u00f3n de im\u00e1genes Docker de PR (.github/workflows/pr-docker-build.yml) permite a cualquier usuario no autenticado ejecutar c\u00f3digo arbitrario durante el proceso de compilaci\u00f3n de Docker y exfiltrar un GITHUB_TOKEN altamente privilegiado (permisos de escritura total). Esto se puede lograr simplemente abriendo una solicitud de extracci\u00f3n desde un fork con un Dockerfile.dev modificado maliciosamente. Este problema ha sido parcheado mediante el commit da44801."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "031E8CE9-E0C5-4ED4-BD59-E846B9525F58", "versionEndExcluding": "2.21.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}