CVE-2026-115932 Details
Description
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
A path traversal vulnerability has been identified in Postiz versions 2.23.0 prior to 2.25.3. When a post is published, the application improperly handles media paths that are not web addresses, treating them as local files without verifying if they reside within the designated upload directory. This oversight allows registered users to manipulate media paths, bypassing standard checks, and have the publishing worker read arbitrary files. These files are then sent as attachments to a Discord server controlled by the user. The vulnerability can also be exploited through two additional methods: one that checks the existence of a file and can overload the backend's memory, and another that retrieves a file in the same manner as the primary exploitation route.
Users can upgrade to Postiz version 2.25.3 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the Postiz GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gadvisory.org/advisories/PSA-2026-E9AHFV | postiz | AdvisoryExploitRemedy |
| https://github.com/gitroomhq/postiz-app | postiz | Source CodeVendor |
| https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a | postiz | Source CodeVendor |
| https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3 | postiz | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | postiz |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | postiz |
Affected Products
| Product | Versions |
|---|---|
| GitroomHQ Postiz | >= 2.23.0, < 2.25.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | postiz |