🔴 Postiz shipped two security releases in about 16 hours. If you updated to 2.25.2 and stopped, check again: 2.25.3 is the first release that addresses all three newly disclosed flaws. The three CVEs break different boundaries: • CVE-2026-115931: a signed-in user could reach unintended provider helper methods, including a local-file read and a backend-exit path. Fixed in 2.25.2. • CVE-2026-115932: a post media path could cross out of the uploads area into server files. The main file-delivery route requires Discord to be configured, but the advisory describes other file routes too. Fixed in 2.25.3. • CVE-2026-115933: tokens for sessions, invitations and password resets shared a signing secret without a marker binding each token to its purpose. A valid signature could therefore be accepted for the wrong workflow. Fixed in 2.25.3. ⚠️ These are vendor-reported, end-to-end demonstrations against unmodified builds. The records reviewed do not establish a customer victim count or exploitation in the wild. CVSS scores of 9.9, 9.6 and 9.9 describe severity, not observed incident volume. For operators: confirm the versions actually running on web and publishing workers; upgrade affected deployments to 2.25.3 or a later release containing all three fixes; review registration settings; preserve relevant logs; and investigate unusual token, media and provider activity. A log match is a lead, not proof of compromise. I mapped the affected version ranges, each trust boundary, the Discord condition and what the advisories leave unanswered here: https://www.pk-sharma.com/briefing/postiz-three-critical-file-read-token-forgery-flaws-2-25-3 #CyberSecurity #Postiz #Vulnerability #AppSec #ThreatIntel
