Critical
Path traversal in post media lets any registered user read server files
Type: advisorySource: Official CVE List
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafte…
Products: postiz-appCVEs: CVE-2026-115932