{"id":"CVE-2026-115932","published":"2026-10-24T13:16:37.217","lastModified":"2026-10-26T16:54:34.940","description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-22","CWE-74"],"vendors":[],"products":[],"references":[{"url":"https://gadvisory.org/advisories/PSA-2026-E9AHFV","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","tags":[]}],"exploitRefs":[{"url":"https://github.com/gitroomhq/postiz-app","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","tags":[]},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","tags":[]}],"hasPoc":true,"ai":{"summary":"The application allows authenticated users to read arbitrary files on the server by providing crafted media paths that bypass directory confinement checks during post publishing, leading to exfiltration of sensitive files via Discord attachments.","exploitability":"Exploitation requires only self-registration (open by default) and no elevated privileges; the attack is straightforward once the vulnerable publishing workflow is triggered.","blast_radius":"An attacker can exfiltrate any file readable by the application process—including configuration files, credentials, source code, and user data—potentially compromising the entire infrastructure.","remediation":"Enforce strict path validation in the media handling logic to ensure all file reads are confined to the designated upload directory (e.g., using canonical path resolution and whitelist checks); upgrade to Postiz version 2.590 or later if a patched release is available.","detection":"Monitor for outbound Discord webhook requests containing unexpected file attachments from the application server, especially those with filenames matching internal paths (e.g., containing '..' or absolute paths like '/etc/passwd'); also log and alert on failed canonical path resolution attempts during media processing.","tags":["path-traversal","file-exfiltration","auth-bypass","web","cloud-native"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:47:29.912Z"}}