Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
⚠️ CVE-2026-115932 (9.6) ⚠️ Postiz lets anyone who signs up read files on the server and send them to a Discord server they control. No fixed version is named, and the affected versions aren't listed. Self-registration is on by default, so anyone can sign up. https://t.co/mYZK939CgA
🔴 Postiz shipped two security releases in about 16 hours. If you updated to 2.25.2 and stopped, check again: 2.25.3 is the first release that addresses all three newly disclosed flaws. The three CVEs break different boundaries: • CVE-2026-115931: a signed-in user could reach unintended provider helper methods, including a local-file read and a backend-exit path. Fixed in 2.25.2. • CVE-2026-115932: a post media path could cross out of the uploads area into server files. The main file-delivery route requires Discord to be configured, but the advisory describes other file routes too. Fixed in 2.25.3. • CVE-2026-115933: tokens for sessions, invitations and password resets shared a signing secret without a marker binding each token to its purpose. A valid signature could therefore be accepted for the wrong workflow. Fixed in 2.25.3. ⚠️ These are vendor-reported, end-to-end demonstrations against unmodified builds. The records reviewed do not establish a customer victim count or exploitation in the wild. CVSS scores of 9.9, 9.6 and 9.9 describe severity, not observed incident volume. For operators: confirm the versions actually running on web and publishing workers; upgrade affected deployments to 2.25.3 or a later release containing all three fixes; review registration settings; preserve relevant logs; and investigate unusual token, media and provider activity. A log match is a lead, not proof of compromise. I mapped the affected version ranges, each trust boundary, the Discord condition and what the advisories leave unanswered here: https://www.pk-sharma.com/briefing/postiz-three-critical-file-read-token-forgery-flaws-2-25-3 #CyberSecurity #Postiz #Vulnerability #AppSec #ThreatIntel