Unauthenticated Path Traversal in Postiz Media Handler

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Postiz, an open-source social media scheduling tool, contains a critical unauthenticated path traversal vulnerability (CVE-2026-19264, CVSS 9.8) in its media serving route. The vulnerability allows attackers to bypass directory restrictions by exploiting URL-encoded path separators that survive initial route matching and are decoded only at the filesystem level, after path normalization checks have already passed. This affects any organization using Postiz for social media management, with no authentication required for exploitation—an attacker can directly access sensitive files stored on the server by crafting malicious URLs with encoded traversal sequences like %2e%2e%2f. The impact is severe: unauthorized file access, information disclosure, and potential lateral movement within affected systems.

Casky's 351 matched skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0007 (Discovery). Practitioners using Casky would observe detections for path traversal attempts (CWE-22), unauthenticated endpoint access patterns, and URL-encoded payload analysis that identifies double-encoded separators bypassing initial validation. The platform would flag suspicious file requests attempting to access parent directories, abnormal file read sequences from the media handler, and reconnaissance activity probing directory structures—enabling security teams to identify exploitation attempts before sensitive data reaches attackers. Real-time analysis of HTTP requests to the vulnerable endpoint combined with behavioral analysis of filesystem access patterns provides defense-in-depth visibility.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19264.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-19264

Casky has 351 skills that investigate the attack patterns behind CVE-2026-19264. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn