{"id":"CVE-2026-115932","aliases":["EUVD-2026-109293","GHSA-rmc2-p2gv-m88f"],"status":"published","title":"Path traversal in post media lets any registered user read server files","description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00428,"percentile":0.37497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-74"],"published":"2026-10-24T12:28:36Z","modified":"2026-11-04T02:30:54Z","products":[{"vendor":"gitroomhq","product":"postiz-app"}],"references":[{"url":"https://github.com/gitroomhq/postiz-app","tags":["product","package"]},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","tags":["release-notes","advisory"]},{"url":"https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","tags":["patch","fix"]},{"url":"https://gadvisory.org/advisories/PSA-2026-E9AHFV","tags":["vendor-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115932","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rmc2-p2gv-m88f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115932.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-115932","title":"Path traversal in post media lets any registered user read server files","description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","status":"published","published":"2026-10-24T12:28:36.033Z","modified":"2026-11-02T14:07:12.305Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-22","CWE-74"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2026-109293","description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","status":"published","published":"2026-10-24T12:28:36Z","modified":"2026-11-02T14:07:12Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:58:45.261111Z"}],"ghsa":[{"id":"GHSA-rmc2-p2gv-m88f","title":"When a post is published, Postiz treats a media path that is not a web address as a file on the...","description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","status":"published","published":"2026-10-24T15:32:53Z","modified":"2026-10-24T15:32:59Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:14:22.008612Z"}],"nvd":[{"id":"CVE-2026-115932","description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","status":"published","published":"2026-10-24T13:16:37.217Z","modified":"2026-11-02T15:17:15.623Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-22","CWE-74"],"updated_at":"2026-11-02T20:51:42.579129Z"}],"osv":[{"id":"CVE-2026-115932","title":"Path traversal in post media lets any registered user read server files","description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","status":"published","published":"2026-10-24T12:28:36.033Z","modified":"2026-11-04T02:30:54.982210974Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22","CWE-74"],"updated_at":"2026-11-04T02:54:44.889498Z"}]}}