---
id: CVE-2026-115932
title: Path traversal in post media lets any registered user read server files
summary: >-
  When a post is published, Postiz treats a media path that is not a web address
  as a file on the server's disk, but it does not check that the file lies
  inside the upload directory. A registered user can store a crafted media path
  with a …
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-74
vendor: GitroomHQ
product: postiz-app
affected:
  - postiz-app >= 2.23.0 < 2.25.3
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:18:20.861Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115932'
references:
  - url: 'https://github.com/gitroomhq/postiz-app'
    label: Postiz
  - url: 'https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3'
    label: v2.25.3
  - url: >-
      https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a
    label: 12db9bd
  - url: 'https://gadvisory.org/advisories/PSA-2026-E9AHFV'
    label: GAdvisory
tags:
  - cve.org
ingestedAt: '2026-10-24T12:58:37.838Z'
---

## Overview

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.

The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.

## Affected

- `postiz-app >= 2.23.0 < 2.25.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue.
If you do not need the Discord provider, leave its client id, client secret and bot token unset. This removes the main route only; the other routes remain.