Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
When a post is published in Postiz, media paths that are not web addresses are treated as files on the server's disk without validating that the file resides within the upload directory. This allows path traversal to arbitrary files on the server. The vulnerability can be exploited through multiple routes: storing a crafted media path with a post that bypasses normal checks, or through endpoint routes that can confirm file existence or deliver files directly. Self-registration is enabled by default, allowing unauthenticated attackers to create accounts.
An unauthenticated attacker can register an account (self-registration is enabled by default) and then read arbitrary files from the server's disk and exfiltrate them as attachments to a Discord server under the attacker's control.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Update Postiz to version 2.25.3 or later. If immediate patching is not possible, disable self-registration to prevent unauthenticated account creation, and restrict network access to the Postiz application. Consider implementing file system access controls to limit the publishing worker's ability to read files outside the designated upload directory.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Feedly found the first article mentioning CVE-2026-115932 . See article
NVD published the first details for CVE-2026-115932
A CVSS base score of 9.6 has been assigned.
GitHub Advisories released a security advisory .
Links to Mitre Att&cks
[GHSA-rmc2-p2gv-m88f] When a post is published, Postiz treats a media path that is not a web address a
CVE-2026-115933: Postiz Shared Secret Flaw Enables Arbitrary Token Forgery and Account Takeover
CVE-2026-115932 - Path traversal in post media lets any registered user read server files CVE ID : CVE-2026-115932 Published : Oct. 24, 2026, 1:16 p.m. | 1 hour, 2 minutes ago Description : When a post is published, Postiz treats a media path that is not a web address as...
CVE-2026-115932 - Exploits & Severity - Feedly
[GHSA-rmc2-p2gv-m88f] When a post is published, Postiz treats a media path that is not a web address a
PSA-2026-E9AHFV: Path traversal in post media lets any registered user read server files · GAdvisory
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
