Postiz: Path traversal in post media allows file read by registered users
Summary
Postiz publishes media from posts by reading local file paths without checking that they lie inside the upload directory. A registered user can store a crafted media path with a post; when the publishing worker runs, it can read arbitrary files the worker can access and send them as an attachment to a Discord server the user controls. Two further routes can confirm whether files exist and deliver file contents in the same way, and one can exhaust the backend's memory. Self-registration is open by default, so an attacker needs no existing account, and readable secrets such as the JWT signing secret could enable account takeover.
Affected
- GitroomHQ postiz-app 2.23.0 up to but not including 2.25.3
- Default configuration is not affected by the main route unless the Discord provider is configured (DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET, DISCORD_BOT_TOKEN_ID)
- Validation-time route requires a Dribbble, TikTok or Pinterest provider
- Stored media route requires local storage with an empty cloud bucket URL
Fixed in
- Upgrade to Postiz 2.25.3 or later
- Fix commit: 12db9bd2f428b628a62809669c3d76297e07750a
Workaround
- Set DISABLE_REGISTRATION=true to close self-registration (reduces exposure, does not fix the issue)
- Leave DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET and DISCORD_BOT_TOKEN_ID unset if Discord is not needed (removes only the main route)
- Restrict outbound connections from the Postiz server to essential services only (third-party suggestion, not verified by the vendor)
Exploitation
- The vendor demonstrated end-to-end exploitation using only a self-registered account.
- No exploitation in the wild has been reported.
- No public proof of concept is known; the working PoC was disclosed to the vendor privately.
- Unknown: whether the vendor's own workaround list covers the two additional routes.
Our recommendation
- Upgrade Postiz to 2.25.3 or later immediately, as the vendor recommends.
- Until patched, disable self-registration and review existing user accounts.
- Check whether the Discord provider is configured and remove its credentials if not needed.
- Rotate secrets (JWT signing secret, database credentials, provider client secrets) if the instance was exposed before patching.
- Monitor logs for unusual media paths and outbound Discord traffic from the Postiz server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- PSA-2026-E9AHFV (GAdvisory vendor advisory) gadvisory.org
- Postiz release v2.25.3 github.com
- Fix commit 12db9bd github.com
- Postiz repository github.com
- Strix CVE mirror www.strix.ai
- VulDB entry vuldb.com
- Ostorlab write-up blog.ostorlab.co
- TheHackerWire mitigations www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:07.
Original description (NVD)
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.