---
id: "CVE-2026-115932"
kind: "vulnerability"
aliases: ["CVE-2026-115932"]
title: "Postiz: media path lets a user read arbitrary server files"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node", "package", "postiz", "self-hosted"]
not_affected_if: ["registration-disabled"]
published_at: "2026-10-24T13:16:37+00:00"
first_seen_at: "2026-10-24T13:17:59+00:00"
updated_at: "2026-10-25T02:59:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115932", "first_seen_at": "2026-10-24T13:17:59+00:00"}]
---

# Postiz: media path lets a user read arbitrary server files

When a post is published, Postiz reads any file on the server's disk named by a crafted media path, because it does not confine the path to the upload directory. A registered user can exfiltrate that file as an attachment to a Discord server they control.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-24T13:17:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115932

## From the sources

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.

The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_