CVE-2026-115931

Summary

A signed-in user can invoke internal backend functions via the Postiz API that were never intended for external use, including one that reads arbitrary server files and another that crashes the service. Because channel tokens may contain file paths, an attacker can read sensitive files like environment variables (including secrets) and cause denial of service.

Exploitability

Low effort to exploit: any authenticated user with a connected channel whose token is a file path can trigger the vulnerable functions; self-registration is enabled by default, so no prior account or victim is required.

Blast radius

Full compromise of server secrets (e.g., session signing keys, database credentials) and service availability are likely if exploited, enabling lateral movement, credential theft, and denial of service.

Detection

Look for requests to internal API endpoints (e.g., paths containing '/internal/', '/helper/', or non-public function names) from authenticated users, especially those with unusual channel tokens that resemble file paths (e.g., starting with '/', './', or containing '..'). Also monitor for unexpected process exits or crashes of the Postiz backend service.

Prioritized remediation

Upgrade to Postiz version 2.590 or later, which restricts callable backend functions to explicitly whitelisted endpoints and sanitizes channel token storage to prevent file path injection.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.