{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apostizpostiz/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gitroom:postiz_app:*:*:*:*:*:*:*:*","cpe:2.3:a:postiz:postiz:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-115932"},{"cvss":9.9,"id":"CVE-2026-115933"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-115932\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["postiz-app","Postiz"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","web-application","cloud"],"_cs_type":"advisory","_cs_vendors":["Gitroom","Postiz"],"content_html":"\u003cp\u003ePostiz is vulnerable to an arbitrary file read (CVE-2026-115932) due to improper input validation. When a post is published, the application treats media paths that are not web addresses as local files on the server's disk without verifying that the file resides within the designated upload directory. An attacker can store a crafted media path with a post to have the publishing worker read an arbitrary file and send it as an attachment to an attacker-controlled Discord server.\u003c/p\u003e\n\u003cp\u003eThe vulnerability can also be exploited to determine if a file exists on the server and to exhaust backend memory. Because self-registration is open by default, an attacker does not require a pre-existing account to exploit these flaws.\u003c/p\u003e\n","date_modified":"2026-10-24T20:17:57Z","date_published":"2026-10-24T14:17:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-postiz-arbitrary-file-read-06bda3fd/","summary":"Postiz fails to validate media paths during post creation, allowing users to read arbitrary files from the server disk and exfiltrate them via Discord attachments.","title":"Postiz: Arbitrary file read via crafted media path (CVE-2026-115932)","url":"https://feed.craftedsignal.io/briefs/2026-10-postiz-arbitrary-file-read-06bda3fd/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:postiz:postiz:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}