CVE-2025-1522 PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability
Authenticated attackers can exploit a Server-Side Request Forgery flaw in PostHog to disclose sensitive information via the database_schema method.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-1522?
CVE-2025-1522 is a high-severity server-side request forgery vulnerability in PostHog, published on 23 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability.
The specific flaw exists within the implementation of the database_schema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-25358.
Weakness: CWE-918
Which versions are affected by CVE-2025-1522?
It affects 1 product.
Products include Posthog Posthog.
How do I fix CVE-2025-1522?
No fix has been published for CVE-2025-1522 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-1522 being exploited?
There is no known exploitation of CVE-2025-1522 in the wild and no public exploit code.
Other vulnerabilities in PostHog
- CVE-2025-1520 PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability
- CVE-2025-1521 PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability
- CVE-2024-9710 PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability
- CVE-2022-0645 Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in posthog/posthog
- CVE-2023-46746 Authenticated PostHog users vulnerable to SSRF
Sources
Also known as GHSA-55cg-p3v8-2vr3.