CVE-2026-115932: CWE-22 in GitroomHQ postiz-app
Affects GitroomHQ postiz-appSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| GitroomHQpostiz-app | Affected
| Fixed in
|
GitHub Actionspostiz-apppkg:github/postiz-appOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a fix is available, restrict or monitor user input for media paths, disable self-registration if possible, and consider isolating the application to limit file system access. Avoid exposing the publishing worker to untrusted input. Follow vendor updates closely for an official fix.
Description
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
Impact
An attacker can read arbitrary files on the server hosting postiz-app, potentially exposing sensitive information. The files are exfiltrated by sending them as attachments to an attacker-controlled Discord server. The vulnerability also allows file existence probing and can cause memory exhaustion on the backend. The impact includes full confidentiality compromise of server files accessible to the application process. Integrity and availability impacts are not indicated. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts.
Summary
The vulnerability in postiz-app arises because when a post is published, media paths not recognized as web addresses are treated as local file paths without verifying that these files reside within the designated upload directory. This lack of directory traversal validation (CWE-22) enables an attacker with a registered account to specify crafted media paths that cause the server to read arbitrary files from its filesystem. These files are then sent as attachments to a Discord server controlled by the attacker. Two additional routes allow the attacker to check file existence and retrieve files similarly, which can also lead to backend memory exhaustion. The default open self-registration lowers the barrier to exploitation.