{"id":"CVE-2026-115932","kind":"vulnerability","aliases":["CVE-2026-115932"],"related":[],"title":"Postiz: media path lets a user read arbitrary server files","description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","summary":"When a post is published, Postiz reads any file on the server's disk named by a crafted media path, because it does not confine the path to the upload directory. A registered user can exfiltrate that file as an attachment to a Discord server they control.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","package","postiz","self-hosted"],"not_affected_if":["registration-disabled"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-24T13:16:37+00:00","first_seen_at":"2026-10-24T13:17:59+00:00","triaged_at":"2026-10-25T02:59:40+00:00","updated_at":"2026-10-25T02:59:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T02:59:40Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Postiz: media path lets a user read arbitrary server files","impact":"high","summary":"When a post is published, Postiz reads any file on the server's disk named by a crafted media path, because it does not confine the path to the upload directory. A registered user can exfiltrate that file as an attachment to a Discord server they control.","category":"package","nicknames":[],"who_cares":["postiz","self-hosted","node"],"confidence":0.6,"needs_auth":"yes","worst_case":"Arbitrary server files read and sent to attacker's Discord.","analyst_note":"Find the fixed Postiz version and the affected version range in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-115932) or the upstream GitHub advisory.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["registration-disabled"],"who_is_affected":"Self-hosted Postiz instances where users can self-register or create posts with media paths. Open self-registration is on by default, so an attacker needs no existing account. Instances that restrict registration to trusted users and do not run the publishing worker with access to sensitive files are less exposed. Managed hosting is not stated in the sources.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000573,"input_tokens":3408,"output_tokens":464,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-115932':13A,16A '-2026':12A,15A 'account':201C 'address':85C 'arbitrari':8A,135C 'attach':63B,142C 'attack':197C 'backend':173C 'caller':164C 'check':98C,123C 'confin':47B 'control':69B,149C 'craft':40B,113C 'cve':11A,14A 'default':194C 'deliv':178C 'directori':53B,106C 'discord':66B,145C 'disk':36B,93C 'exfiltr':58B 'exhaust':171C 'exist':168C,200C 'file':10A,31B,60B,88C,101C,136C,167C,180C 'get':119C 'host':22B 'insid':103C 'let':4A 'lie':102C 'main':186C 'media':2A,41B,78C,114C 'memori':175C 'name':37B 'need':198C 'node':17B 'normal':125C 'one':161C 'open':192C 'packag':18B 'past':121C 'path':3A,42B,49B,79C,115C 'post':25B,72C,118C 'postiz':1A,19B,28B,75C 'publish':27B,74C,131C 'reach':156C 'read':7A,29B,133C,153C 'regist':55B,108C 'registr':190C 'restrict':126C 'rout':160C,187C 'self':21B,189C 'self-host':20B 'self-registr':188C 'send':138C 'server':9A,34B,67B,91C,146C 'store':111C 'tell':162C 'treat':76C 'two':158C 'unconfin':152C 'upload':52B,105C 'user':6A,56B,109C,148C 'way':183C 'web':84C 'whether':165C 'worker':132C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Postiz instances where users can self-register or create posts with media paths. Open self-registration is on by default, so an attacker needs no existing account. Instances that restrict registration to trusted users and do not run the publishing worker with access to sensitive files are less exposed. Managed hosting is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"4cdc9741-f887-419a-a2fd-acbbd2729276","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115932","severity":null,"published_at":"2026-10-24T13:16:37+00:00","modified_at":"2026-10-24T13:16:37+00:00","first_seen_at":"2026-10-24T13:17:59+00:00","fetched_at":"2026-10-24T13:17:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}