CVE-2026-115932: Path traversal in post media lets any registered user read server files

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-24 · updated 2026-10-26
Weakness: CWE-22

Description

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.

Summary

CVE-2026-115932 is a critical path traversal flaw in Postiz: when publishing a post, the app treats a non-URL media path as a local file without verifying it stays inside the upload directory, letting a registered user read arbitrary server files and exfiltrate them as Discord attachments. Two additional routes allow file-existence checks, memory exhaustion, and the same file delivery. Self-registration is open by default, so no existing account is needed; gitroomhq postiz-app is affected and fixed in 2.25.3. It is not in CISA KEV and EPSS estimates a 0.4% chance of exploitation in 30 days. Upgrade to 2.25.3 and disable open self-registration where possible.

CVE-2026-115932 هو ثغرة اجتياز مسار حرجة في Postiz: عند نشر منشور، يتعامل التطبيق مع مسار وسائط غير عنوان ويب كملف على قرص الخادم دون التحقق من وجوده داخل مجلد الرفع، ما يتيح لمستخدم مسجّل قراءة ملفات خادم عشوائية وإرسالها كمرفقات إلى Discord يتحكم به المهاجم. وتوجد مسارات إضافية تسمح بفحص وجود الملفات واستنزاف ذاكرة الخادم وتسليم الملف بالطريقة نفسها. التسجيل الذاتي مفتوح افتراضياً، لذا لا يحتاج المهاجم إلى حساب قائم؛ المنتج المتأثر هو gitroomhq postiz-app وأُصلح في 2.25.3. الثغرة ليست في CISA KEV وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بـ 0.4%. يُنصح بالترقية إلى 2.25.3 وتعطيل التسجيل الذاتي المفتوح حيث أمكن.

Affected products

gitroomhq postiz-app: from 2.23.0 before 2.25.3 — fixed in 2.25.3

How to fix

Upgrade to a fixed version: gitroomhq postiz-app 2.25.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-115932 or the next vulnerability affects your stack