CVE-2026-115932

Summary

The application allows authenticated users to read arbitrary files on the server by providing crafted media paths that bypass directory confinement checks during post publishing, leading to exfiltration of sensitive files via Discord attachments.

Exploitability

Exploitation requires only self-registration (open by default) and no elevated privileges; the attack is straightforward once the vulnerable publishing workflow is triggered.

Blast radius

An attacker can exfiltrate any file readable by the application process—including configuration files, credentials, source code, and user data—potentially compromising the entire infrastructure.

Detection

Monitor for outbound Discord webhook requests containing unexpected file attachments from the application server, especially those with filenames matching internal paths (e.g., containing '..' or absolute paths like '/etc/passwd'); also log and alert on failed canonical path resolution attempts during media processing.

Prioritized remediation

Enforce strict path validation in the media handling logic to ensure all file reads are confined to the designated upload directory (e.g., using canonical path resolution and whitelist checks); upgrade to Postiz version 2.590 or later if a patched release is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.