{"id":"CVE-2026-115932","revision":"2e85e0ee1b624584beb8f3b192c745be","records":[{"revision":"2e85e0ee1b624584beb8f3b192c745be","observedAt":"2026-10-24T16:17:04.479+00:00","statement":{"source":"cve-program","id":"CVE-2026-115932","aliases":[],"title":"Path traversal in post media lets any registered user read server files","description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","state":0,"publishedAt":"2026-10-24T12:28:36.033+00:00","modifiedAt":"2026-10-24T14:18:20.861+00:00","affected":[{"ecosystem":"Vendor product","name":"postiz-app","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"GitroomHQ\",\n                    \"product\": \"postiz-app\",\n                    \"packageName\": \"postiz-app\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"2.23.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"2.25.3\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/gitroomhq/postiz-app\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","https://gadvisory.org/advisories/PSA-2026-E9AHFV"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115932","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115932","identifiers":["CVE-2026-115932"]},"retained":false,"historicalAffected":[]}],"coverage":[]}