Zero Radar
← feed
CriticalVulnerabilityCVE-2026-115932updated 25 Oct 2026, 17:20 UTC

Postiz lets registered users read server files and leak them to Discord

A logged-in user can trick the app into reading private files stored on its server, such as configuration or secret keys, and sending them out through a Discord message. Anyone who can sign up may be able to do this.

Official, 2 sources
SeverityCriticalCVSS 9.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Registered userSigns up, open registration is the default
  2. 2Crafted media pathNon-URL path saved with a post
  3. 3Publishing workerReads any file, no upload-directory check
  4. 4File sent outAttached to a Discord server the user controls
  5. ResultServer files leak to attacker's Discord

What happened

Postiz treats a media path that is not a web address as a local file path but does not confine it to the upload directory, allowing arbitrary server file reads via post publishing, with delivery as a Discord attachment; two further routes expose file existence checks and file delivery.

Why it is dangerous: An attacker can read sensitive server files such as credentials and secrets and exfiltrate them, and the same flaw can exhaust backend memory. Open self-registration means no existing account is needed.

Are you affected?

You are affected if you run Postiz with open self-registration enabled (the default) on a version that does not include the fix.

Postiz (exact affected versions not stated in the provided material)

What to do

  1. Check whether your Postiz instance has open self-registration enabled and disable it if you do not need it
  2. Update Postiz to a version that includes the fix from the GitHub advisory GHSA-rmc2-p2gv-m88f as soon as it is available
  3. Review server logs and restrict read access to sensitive files and secrets until patched

Timeline

  1. 24 Oct 2026, 13:16 UTC
    Publicly disclosed
  2. 24 Oct 2026, 13:16 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115932 · GHSA-rmc2-p2gv-m88f
CVSS
9.6 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
24 Oct 2026, 13:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Postiz lets registered users read server files and leak them to Discord · Zero Radar