Critical
Arbitrary file read and backend crash through unrestricted provider method calls
Type: advisorySource: Official CVE List
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that wer…
Products: postiz-appCVEs: CVE-2026-115931