CVE-2026-115932
Path traversal in post media lets any registered user read server files
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | L | Regular user |
| User interaction UI | N | None |
| Scope S | C | Changed (affects other components) |
| Confidentiality C | H | High |
| Integrity I | H | High |
| Availability A | N | None |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Description
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
Workarounds (CNA)
Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue.
If you do not need the Discord provider, leave its client id, client secret and bot token unset. This removes the main route only; the other routes remain.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / 4cdc9741-f887-419a-a2fd-acbbd2729276 (Secondary) | 3.1 | 9.6 CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| CNA / postiz | 3.1 | 9.6 CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| GitroomHQ | postiz-app | affected: 2.23.0 … < 2.25.3 default: unaffected |
Linux distribution status
References (4)
- https://gadvisory.org/advisories/PSA-2026-E9AHFV NVD, CNA vendor-advisory
- https://github.com/gitroomhq/postiz-app NVD, CNA product
- https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a NVD, CNA patch
- https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3 NVD, CNA release-notes