https://feed.craftedsignal.io/cpes/cpe2.3apostizpostiz/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 14:17:02 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-postiz-arbitrary-file-read-06bda3fd/Sat, 24 Oct 2026 14:17:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-postiz-arbitrary-file-read-06bda3fd/Postiz fails to validate media paths during post creation, allowing users to read arbitrary files from the server disk and exfiltrate them via Discord attachments.<p>Postiz is vulnerable to an arbitrary file read (CVE-2026-115932) due to improper input validation. When a post is published, the application treats media paths that are not web addresses as local files on the server's disk without verifying that the file resides within the designated upload directory. An attacker can store a crafted media path with a post to have the publishing worker read an arbitrary file and send it as an attachment to an attacker-controlled Discord server.</p> <p>The vulnerability can also be exploited to determine if a file exists on the server and to exhaust backend memory. Because self-registration is open by default, an attacker does not require a pre-existing account to exploit these flaws.</p> criticaladvisoryauthentication-bypassweb-applicationcloud