Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2026-42298— Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

CVSS 10.0 · Critical EPSS 0.14% · P33
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-42298

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
Source: NVD (National Vulnerability Database)
Vulnerability Description
Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Gitroom Postiz 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gitroom Postiz是Gitroom开源的一个社交媒体日程安排工具。 Gitroom Postiz da44801之前版本存在代码注入漏洞，该漏洞源于构建和发布PR Docker镜像工作流中存在Pwn Request漏洞，可能导致未授权用户在Docker构建过程中执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
gitroomhqpostiz-app < da448012dd87e94944cbe83a38e7fd023269ec46 -

II. Public POCs for CVE-2026-42298

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-42298

请登录查看更多情报信息。

Same Patch Batch · gitroomhq · 2026-05-08 · 3 CVEs total

CVE-2026-425568.9 HIGHPostiz stored XSS in public preview page
CVE-2026-423466.5 MEDIUMPostiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths

IV. Related Vulnerabilities

Same product: postiz-app
Same vendor: gitroomhq
Same weakness: CWE-94

V. Comments for CVE-2026-42298

No comments yet

Leave a comment