{"schema_version":"2","view":"grouped","data":[{"id":56301,"cve_ids":["CVE-2026-115932"],"payload":{"kind":"advisory","title":"Path traversal in post media lets any registered user read server files","summary":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","evidence":"cve:CVE-2026-115932","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115932","aliases":["CVE-2026-115932"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.23.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:18:20.861Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","https://gadvisory.org/advisories/PSA-2026-E9AHFV"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:18:20.861Z"}}},"related_cves":[{"value":"CVE-2026-115932","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115932","advisory_id":"98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","event_types":["advisory"],"published_at":"2026-10-25T16:12:34.648264+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T12:28:36.033+00:00","detail_url":"/advisories/advisory%3A98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","group":{"id":"advisory:98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","revision":1,"primary_event_id":55824,"change":"published","superseded_by":[],"changed":{"id":55824,"cve_ids":["CVE-2026-115932"],"payload":{"kind":"advisory","title":"Path traversal in post media lets any registered user read server files","summary":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","evidence":"cve:CVE-2026-115932","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115932","aliases":["CVE-2026-115932"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.23.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:18:20.861Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","https://gadvisory.org/advisories/PSA-2026-E9AHFV"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:18:20.861Z"}}},"related_cves":[{"value":"CVE-2026-115932","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115932","advisory_id":"98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","event_types":["advisory"],"published_at":"2026-10-25T16:12:34.648264+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T12:28:36.033+00:00","detail_url":"/events/55824"},"members":[{"id":55824,"cve_ids":["CVE-2026-115932"],"payload":{"kind":"advisory","title":"Path traversal in post media lets any registered user read server files","summary":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","evidence":"cve:CVE-2026-115932","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115932","aliases":["CVE-2026-115932"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.23.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:18:20.861Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","https://gadvisory.org/advisories/PSA-2026-E9AHFV"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:18:20.861Z"}}},"related_cves":[{"value":"CVE-2026-115932","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115932","advisory_id":"98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","event_types":["advisory"],"published_at":"2026-10-25T16:12:34.648264+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T12:28:36.033+00:00","detail_url":"/events/55824"}]}}],"next_after":56301,"next_before":56301}