CVE-2026-19264: Postiz Path Traversal Vulnerability

CVE-2026-19264 Overview

Postiz, an open-source social media scheduling tool, contains a path traversal vulnerability in the route that serves locally stored media. The handler joins URL-supplied path segments onto the upload directory and streams the file without normalizing the path or confining it to that directory. The route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can read any file readable by the application process, including the process environment, exposing the JSON Web Token (JWT) signing secret, database connection string, and provider secrets.

Critical Impact
Attackers can read the JWT signing secret and forge non-expiring session tokens as any user, including administrators, without a password.

Affected Products

Postiz (gitroomhq/postiz-app) prior to v2.22.1
Self-hosted Postiz deployments serving /api/uploads/[[...path]]
Cloud deployments running vulnerable Postiz versions

Discovery Timeline

2026-08-07 - CVE-2026-19264 published to NVD
2026-08-07 - Last updated in NVD database
Patch release - v2.22.1 published on GitHub with fix commit 7936062

Technical Details for CVE-2026-19264

Vulnerability Analysis

The vulnerability resides in the Next.js catch-all route at apps/frontend/src/app/(app)/api/uploads/[[...path]]/route.ts. The handler accepts arbitrary path segments through the [[...path]] parameter and concatenates them onto the local upload directory before streaming the resulting file. The route enforces no authentication and performs no canonicalization of the resolved path.

The framework layer collapses raw ../ sequences during route matching, which gives the appearance of protection. However, percent-encoded traversal sequences such as %2e%2e%2f bypass the framework normalization step. The handler then URL-decodes these segments before passing them to createReadStream, reconstructing the traversal at the filesystem boundary. This pattern maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Because Postiz signs session JWTs with a secret loaded from the process environment and issues tokens with no expiry claim, disclosure of .env yields permanent session forgery. An attacker escalates from arbitrary file read to full administrative account takeover in a single step.

Root Cause

The upload route trusts client-supplied path segments and lacks two controls: canonicalization of the joined path via resolve() and verification that the result begins with the intended upload directory. Authentication is also absent on a route that streams filesystem content.

Attack Vector

An unauthenticated remote attacker issues an HTTP GET request to the uploads route with URL-encoded traversal sequences. The handler decodes the sequences and returns the contents of any file readable by the Node.js process, including .env, /etc/passwd, and application source files.

typescript

// Patch from commit 7936062 (apps/frontend/src/app/(app)/api/uploads/[[...path]]/route.ts)
 import { NextRequest, NextResponse } from 'next/server';
 import { createReadStream, statSync } from 'fs';
+import { resolve, sep } from 'path';
 // @ts-ignore
 import mime from 'mime';
 async function* nodeStreamToIterator(stream: any) {

The patch imports resolve and sep from Node's path module, enabling canonicalization of the joined path and a prefix check against the upload directory before streaming. Source: GitHub Commit 7936062.

Detection Methods for CVE-2026-19264

Indicators of Compromise

HTTP requests to /api/uploads/ containing URL-encoded traversal sequences such as %2e%2e%2f, %2e%2e/, or ..%2f
Requests to the uploads route referencing sensitive filenames such as .env, config.json, or id_rsa
Authenticated sessions originating from unusual IP addresses using tokens that predate the request window
Administrator actions performed by accounts without corresponding login events

Detection Strategies

Inspect web server and reverse proxy logs for encoded traversal patterns targeting /api/uploads/*
Correlate uploads-route responses returning non-media MIME types or unusually large payloads
Alert on JWT usage where the iat claim significantly precedes the account's most recent password reset

Monitoring Recommendations

Enable WAF rules that decode and normalize URL paths before signature matching
Ship Postiz application logs and reverse proxy logs to a central SIEM for retention and correlation
Monitor for outbound connections from the Postiz host to unfamiliar OAuth or billing provider endpoints, indicating stolen provider secrets in use

How to Mitigate CVE-2026-19264

Immediate Actions Required

Upgrade Postiz to v2.22.1 or later, which contains the fix in commit 7936062
Rotate the JWT signing secret, database credentials, and every connected provider and billing secret referenced in the application environment
Invalidate all existing sessions and require users to re-authenticate after secret rotation
Audit administrator accounts and recent privileged actions for signs of forged sessions

Patch Information

The fix is available in Postiz v2.22.1. The patch commit 7936062 introduces path canonicalization using resolve() and enforces that resolved paths remain confined to the upload directory. Refer to the Gadvisory Security Advisory PSA-2026-TH12B7 for full remediation guidance.

Workarounds

Place Postiz behind a reverse proxy or WAF that rejects URL-encoded traversal sequences on /api/uploads/*
Restrict the Node.js process user to read only the intended upload directory using filesystem ACLs or a chroot equivalent
Add an expiry (exp) claim to issued JWTs and enforce short session lifetimes as a defense-in-depth measure

bash

# Example nginx rule to block encoded traversal on the uploads route
location /api/uploads/ {
    if ($request_uri ~* "(%2e%2e|\.\.)(%2f|/|%5c|\\)") {
        return 400;
    }
    proxy_pass http://postiz_upstream;
}