Sploitus Critical Path Traversal Vulnerability in Postiz Exposes Server Files
Article Content
- •CVE-2026-115932 allows path traversal in Postiz, enabling file access.
- •Unauthenticated users can exploit the flaw due to default self-registration.
- •Patching is critical as the CVSS score is 9.6, indicating severe risk.
A critical vulnerability, CVE-2026-115932, has been identified in Postiz, allowing unauthenticated users to exploit path traversal flaws. This vulnerability permits registered users to craft media paths that bypass directory restrictions, enabling access to arbitrary server files. Attackers can exfiltrate sensitive data by sending these files as attachments to a Discord server they control. Self-registration is enabled by default, increasing the risk of exploitation. Although no public proof-of-concept or evidence of has been reported, the CVSS score is 9.6, indicating a critical severity level. Immediate patching to version 2.25.3 or later is recommended, along with disabling self-registration as a temporary measure. The vulnerability was disclosed on October 24, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track CVE-2026-115932 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of Postiz are affected?
Is there evidence of active exploitation?
What should I do to mitigate this vulnerability?
Continue Reading
CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting… Path Traversal Vulnerability in WinRAR Exploited by RomCom Group CVE-2025-8088 is a path traversal vulnerability in WinRAR versions up to 7.12, allowing attackers to exploit alternate data streams (ADSes) in RAR files to extract malicious payloads to sensitive system locations. Exploitation began in the wild on July 18, 2025, with attackers linked to the Russia-aligned RomCom…