Live › vulnerability › CVE-2026-115932
Go to dashboardWhen a post is published, Postiz reads any file on the server's disk named by a crafted media path, because it does not confine the path to the upload directory. A registered user can exfiltrate that file as an attachment to a Discord server they control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 13:17 UTC. All times on this page are UTC.
Self-hosted Postiz instances where users can self-register or create posts with media paths. Open self-registration is on by default, so an attacker needs no existing account. Instances that restrict registration to trusted users and do not run the publishing worker with access to sensitive files are less exposed. Managed hosting is not stated in the sources.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.
The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
This page as .md · .json · in your agent: get_signal("CVE-2026-115932")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.