CVE-2026-42298
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Postiz, an AI social media scheduling tool, prior to commit da44801 contains a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow. Any unauthenticated user can execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions) by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev.
Risk Assessment
An attacker can gain full control over the GitHub repository and perform any operations on behalf of the project, potentially leading to malicious code injection or data theft.
Recommendation
Apply commit da44801, which fixes this vulnerability, or upgrade Postiz to a version containing this fix.
Original NVD description (English source)
Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.