Path traversal in Postiz lets registered users read server files
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
GitroomHQ postiz-app from 2.23.0 before 2.25.3 has a path traversal flaw (CWE-22) in which a media path that is not a web address is read from the server disk without checking that it lies inside the upload directory. A registered user can store a crafted media path with a post so the publishing worker reads an arbitrary file and sends it as an attachment to a Discord server the user controls. Self-registration is open by default, so an attacker needs no existing account.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade GitroomHQ postiz-app to version 2.25.3, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA postiz-app (GitroomHQ) Fixed in 2.25.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
GitroomHQ postiz-app 2.25.3
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-80074 Forged signed tokens in Postiz let users take over other accountsPriority MEDIUM 42
Timeline
- 2026-10-24 Threatist record created from CVE-2026-115932
- 2026-10-24 Alias added: GHSA-rmc2-p2gv-m88f
- 2026-11-02 CISA SSVC decision points changed
More gitroomhq vulnerabilities
- TI-2026-26825 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVSS 3.1HIGH 8.6
- TI-2026-28982 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CVSS 3.1HIGH 8.2
- TI-2026-29238 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVSS 3.1CRITICAL 9.0
- TI-2026-26824 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVSS 4.0HIGH 8.3
- TI-2026-26837 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVSS 3.1MEDIUM 5.4
- TI-2026-15715 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-115932 · CVE Program
- CVE-2026-115932 · NVD
- FIRST EPSS
- GHSA-rmc2-p2gv-m88f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences