File Read Vulnerability in Postiz Web Application by Gitroom

CVE-2026-115932

What is CVE-2026-115932?

The vulnerability in the Postiz application arises when a post is published, wherein it incorrectly interprets a media path that is not a valid web address as a local file on the server's disk. It fails to validate that the file lies within the designated upload directory, permitting a registered user to craft a malicious media path. This can lead to unauthorized reading of arbitrary files, which may be sent as attachments to a Discord server controlled by the user. Additionally, multiple access routes allow the attacker to check for file existence, potentially exhausting backend memory resources, or delivering the files similarly to the main access point. Since self-registration is enabled by default, attackers can exploit this vulnerability without needing an existing account.

References