CVE-2026-42298 - Vulnerability Analysis

Overview

Postiz contains a remote code execution vulnerability caused by processing untrusted Dockerfile.dev in the Build and Publish PR Docker Image workflow, letting unauthenticated attackers execute arbitrary code and exfiltrate privileged GITHUB_TOKEN, exploit requires opening a malicious forked pull request.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary code and steal highly privileged tokens, leading to full repository compromise.

Mitigation

Update to the version including commit da44801 or later.

References

• https://github.com/gitroomhq/postiz-app/commit/da448012dd87e94944cbe83a38e7fd023269ec46
• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v975-9h5p-xhm4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner