# CVE-2026-42298: Gitroom Postiz code injection in GitHub Actions workflow

Source: https://junglewise.ai/threats/cve-2026-42298-gitroom-postiz-code-injection-in-github-actions-workflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-42298 · Severity: critical · CVSS 10 · Published 2026-05-08

A security flaw in the automated build system for Postiz, a social media scheduling tool, allows unauthorized individuals to take control of the software's development environment. By submitting a malicious contribution request, an attacker can steal high-level access keys, allowing them to modify the application's source code, delete data, or release fraudulent versions of the software. This poses a severe risk to the integrity of the product and the security of its users.

Technologies: [Gitroom Postiz](https://junglewise.ai/threats/technologies/postiz). Vendors: [Gitroom](https://junglewise.ai/threats/vendors/gitroom).

## Quick answers

**Is CVE-2026-42298 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42298 being exploited in the wild.

**How severe is CVE-2026-42298?** Critical severity, with a CVSS score of 10, published 8 May 2026.

**Which products and versions are affected?** Gitroom Postiz Before commit da44801, Prior to commit da44801.

**Is there a fix for CVE-2026-42298?** A patch was published on 2026-04-22: Fix developed and published via commit da44801 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42298 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-42298?** Check whether you run Gitroom Postiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A 'Pwn Request' vulnerability exists in the 'Build and Publish PR Docker Image' workflow (.github/workflows/pr-docker-build.yml). The root cause is the execution of a Docker build process using a 'Dockerfile.dev' that can be modified by external contributors in a Pull Request. An unauthenticated attacker can submit a PR from a fork containing a malicious Dockerfile; when the automated workflow triggers, it executes the attacker's code within the runner environment. This environment has access to a GITHUB_TOKEN with 'write-all' permissions, which can be exfiltrated to grant the attacker full read/write access to the repository, including the ability to modify code and manage releases. The issue was resolved by removing the insecure workflow in commit da44801.

## Affected products

- Gitroom Postiz Before commit da44801

## Timeline

- 2026-04-22: disclosed: Advisory received and acknowledged by Postiz
- 2026-04-22: patched: Fix developed and published via commit da44801
- 2026-04-26: advisory: CVE-2026-42298 assigned
- 2026-05-08: advisory: NVD publication date

## References

- [https://github.com/gitroomhq/postiz-app/commit/da448012dd87e94944cbe83a38e7fd023269ec46](https://github.com/gitroomhq/postiz-app/commit/da448012dd87e94944cbe83a38e7fd023269ec46)
- [https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v975-9h5p-xhm4](https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v975-9h5p-xhm4)

## Related threats

- [Gitroomhq Postiz authorization bypass in Nowpayments webhook](https://junglewise.ai/threats/cve-2026-48799-gitroomhq-postiz-authorization-bypass-in-nowpayments-webhook)
- [Postiz billing enforcement bypass in modify-subscription endpoint](https://junglewise.ai/threats/cve-2026-48783-postiz-billing-enforcement-bypass-in-modify-subscription-endpoint)
- [Postiz privilege escalation via JWT forgery in Skool integration](https://junglewise.ai/threats/cve-2026-48781-postiz-privilege-escalation-via-jwt-forgery-in-skool-integration)
- [Gitroom Postiz stored XSS in public preview page](https://junglewise.ai/threats/cve-2026-42556-gitroom-postiz-stored-xss-in-public-preview-page)
- [Postiz SSRF via DNS Rebinding TOCTOU in URL Validation](https://junglewise.ai/threats/cve-2026-42346-postiz-ssrf-via-dns-rebinding-toctou-in-url-validation)