Is CVE-2026-115932 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115932 being exploited in the wild.

How severe is CVE-2026-115932?

Critical severity, with a CVSS score of 9.6, published 24 October 2026.

Which products and versions are affected?

GitroomHQ Postiz-App 2.23.0 through 2.25.2.

How is CVE-2026-115932 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115932?

Check whether you run GitroomHQ Postiz-App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115932: Postiz path traversal in post media processing

CVE-2026-115932 · Severity: critical · CVSS 9.6 · Published 2026-10-24

Postiz is a social media scheduling and publishing tool used by organizations to manage content across multiple platforms. A vulnerability allows any registered user to read arbitrary files from the server where Postiz runs, including sensitive configuration files and secrets, and have them delivered to a Discord server under the attacker's control. Since self-registration is enabled by default, an attacker does not need an existing account to exploit this.

Technologies: GitroomHQ Postiz-App. Vendors: GitroomHQ.

Quick answers

Is CVE-2026-115932 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115932 being exploited in the wild.
How severe is CVE-2026-115932?: Critical severity, with a CVSS score of 9.6, published 24 October 2026.
Which products and versions are affected?: GitroomHQ Postiz-App 2.23.0 through 2.25.2.
Is there a fix for CVE-2026-115932?: Yes: fixed in 2.25.3. Until then: Set DISABLE_REGISTRATION=true to close self-registration and limit access to existing account holders only. If the Discord provider is not needed, leave DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET, and DISCORD_BOT_TOKEN_ID unset to disable the main attack route (though other file-read routes remain reachable). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115932 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115932?: Check whether you run GitroomHQ Postiz-App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.25.3

Set DISABLE_REGISTRATION=true to close self-registration and limit access to existing account holders only. If the Discord provider is not needed, leave DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET, and DISCORD_BOT_TOKEN_ID unset to disable the main attack route (though other file-read routes remain reachable).

Technical details

The publishing worker fails to validate that media file paths remain within the upload directory, allowing path traversal attacks. A registered user can craft a media path with directory traversal sequences, which the worker then reads and transmits as an attachment to Discord. Two additional routes enable file existence detection (causing memory exhaustion via device files) and unconfined file reading without Discord provider configuration. The worker runs as root by default, exposing all root-readable files.

Affected products

GitroomHQ postiz-app 2.23.0 through 2.25.2

Timeline

2026-10-23: disclosed: Anthropic disclosed vulnerability and working PoC to Postiz
2026-10-24: advisory: PSA-2026-E9AHFV and CVE-2026-115932 published
2026-10-24: patched: Fixed in version 2.25.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.