Vendor
critical
advisory
Postiz: Arbitrary file read via crafted media path (CVE-2026-115932)
1 TTP 2 CVEsPostiz fails to validate media paths during post creation, allowing users to read arbitrary files from the server disk and exfiltrate them via Discord attachments.
PoC
postiz-app +1
authentication-bypass
web-application
cloud
1t
2c
updated
critical
advisory
Critical Path Traversal in Postiz Exploited for Instance Takeover
1 rule 2 TTPs 1 CVEAn unauthenticated path traversal vulnerability (CVE-2026-19264) in Postiz enables remote attackers to read sensitive configuration files, facilitate JWT secret theft, and achieve full instance takeover through forged administrative sessions.
Postiz
path-traversal
instance-takeover
cve-2026-19264
1r
2t
1c