{"id":"CVE-2026-115931","published":"2026-10-23T23:17:43.263","lastModified":"2026-10-26T16:54:34.940","description":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.\n\nOne of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-73","CWE-470"],"vendors":[],"products":[],"references":[{"url":"https://gadvisory.org/advisories/PSA-2026-JNXM56","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.2","tags":[]}],"exploitRefs":[{"url":"https://github.com/gitroomhq/postiz-app","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.2","tags":[]}],"hasPoc":true,"ai":{"summary":"A signed-in user can invoke internal backend functions via the Postiz API that were never intended for external use, including one that reads arbitrary server files and another that crashes the service. Because channel tokens may contain file paths, an attacker can read sensitive files like environment variables (including secrets) and cause denial of service.","exploitability":"Low effort to exploit: any authenticated user with a connected channel whose token is a file path can trigger the vulnerable functions; self-registration is enabled by default, so no prior account or victim is required.","blast_radius":"Full compromise of server secrets (e.g., session signing keys, database credentials) and service availability are likely if exploited, enabling lateral movement, credential theft, and denial of service.","remediation":"Upgrade to Postiz version 2.590 or later, which restricts callable backend functions to explicitly whitelisted endpoints and sanitizes channel token storage to prevent file path injection.","detection":"Look for requests to internal API endpoints (e.g., paths containing '/internal/', '/helper/', or non-public function names) from authenticated users, especially those with unusual channel tokens that resemble file paths (e.g., starting with '/', './', or containing '..'). Also monitor for unexpected process exits or crashes of the Postiz backend service.","tags":["file-read","denial-of-service","auth-bypass","web-api","secrets-exposure"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:53:17.303Z"}}