Postiz: Arbitrary file read via crafted media path (CVE-2026-115932)
Postiz fails to validate media paths during post creation, allowing users to read arbitrary files from the server disk and exfiltrate them via Discord attachments.
CVE search metadata
CVE search record: CVE-2026-115932. Severity: critical. CVSS: 9.6. KEV: no. Product: postiz-app. Brief: Postiz: Arbitrary file read via crafted media path (CVE-2026-115932). Brief link: https://feed.craftedsignal.io/briefs/2026-10-postiz-arbitrary-file-read-06bda3fd/
Triage facts
Revision 2- Applicability
- postiz-app
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 24, 15:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_products, affected_vendors, cpes, has_poc, lastmod, poc_references, references, updates
Sources: 1
Postiz is vulnerable to an arbitrary file read (CVE-2026-115932) due to improper input validation. When a post is published, the application treats media paths that are not web addresses as local files on the server's disk without verifying that the file resides within the designated upload directory. An attacker can store a crafted media path with a post to have the publishing worker read an arbitrary file and send it as an attachment to an attacker-controlled Discord server.
The vulnerability can also be exploited to determine if a file exists on the server and to exhaust backend memory. Because self-registration is open by default, an attacker does not require a pre-existing account to exploit these flaws.