Executive Summary
CVE-2026-115932 is a critical flaw (CVSS 9.6) in Postiz, a self-hostable social media scheduling tool. When a post is published, Postiz treats a media path that is not a web address as a file on the server's own disk, but it does not confirm that the file sits inside the upload directory. NVD published the entry on October 24, 2026.
A registered user can store a crafted media path with a post and get it past the checks that normally restrict it, so the server reads a file it was never meant to expose.
Vulnerability Overview
| Field | Detail |
|---|---|
| CVE | CVE-2026-115932 |
| CVSS | 9.6 (Critical) |
| Weakness class | Path traversal / missing upload-directory containment |
| Authentication | Any registered account |
| Published | October 24, 2026 |
The NVD description is truncated in the source feed, so the full impact statement should be confirmed on the NVD entry. Path traversal of this kind generally exposes configuration files, environment files, and credentials on the host.
Impact
- Secret exposure: application
.envfiles, database credentials, and OAuth tokens for connected social accounts could be read. - Pivoting: leaked social-platform tokens allow posting as the organisation; leaked database credentials extend the reach to the host.
- Low barrier: self-service registration on an internet-facing instance makes the "registered user" requirement trivial.
Remediation
- Upgrade Postiz to the release that fixes CVE-2026-115932 once published by the maintainers; check the project's GitHub releases and security advisories.
- Until patched, disable open registration and review existing accounts.
- Restrict access to the instance by VPN or IP allow-list.
- Rotate every secret the Postiz host can read, including social API tokens and database passwords, if you suspect exposure.
- Review application logs for posts whose media paths are not web URLs or upload-directory files.