CVE-2025-1522: PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability
First published: Wed Apr 23 2025(Updated: )
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the database_schema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-25358.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PostHog |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1522?
CVE-2025-1522 has a medium severity rating due to its potential to disclose sensitive information.
How do I fix CVE-2025-1522?
To fix CVE-2025-1522, update your PostHog installation to the latest version that addresses this vulnerability.
Who is affected by CVE-2025-1522?
PostHog users with installations that allow authentication and have not implemented mitigation measures are affected by CVE-2025-1522.
What kind of information can be disclosed due to CVE-2025-1522?
CVE-2025-1522 allows remote attackers to potentially disclose sensitive information such as user data from the PostHog database.
Is authentication required to exploit CVE-2025-1522?
Yes, authentication is required to exploit CVE-2025-1522.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-25-097
- alias/ZDI-CAN-25358
- alias/CVE-2025-1522
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/posthog
- canonical/posthog