CVE-2025-1522: PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability
PostHog databaseschema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability.
The specific flaw exists within the implementation of the databaseschema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-25358.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1522?
CVE-2025-1522 has a medium severity rating due to its potential to disclose sensitive information.
How do I fix CVE-2025-1522?
To fix CVE-2025-1522, update your PostHog installation to the latest version that addresses this vulnerability.
Who is affected by CVE-2025-1522?
PostHog users with installations that allow authentication and have not implemented mitigation measures are affected by CVE-2025-1522.
What kind of information can be disclosed due to CVE-2025-1522?
CVE-2025-1522 allows remote attackers to potentially disclose sensitive information such as user data from the PostHog database.
Is authentication required to exploit CVE-2025-1522?
Yes, authentication is required to exploit CVE-2025-1522.