CVE-2026-115931: Arbitrary file read and backend crash through unrestricted provider method calls
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.
One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this in a default deployment?
Any user who can sign in can exploit it. Because self-registration is open by default, an attacker does not need a pre-existing account or interaction from another user.
What access can an attacker obtain?
An attacker can cause the backend to return any file readable by the server by connecting a channel whose stored token is a file path. This can expose environment contents, including the session-signing secret, database address, and credentials for connected services.
Can this be used to disrupt service availability?
Yes. An attacker can invoke an internal helper that causes the backend process to exit with a single request.
What needs to be true for file disclosure to work?
The attacker needs to be signed in and able to connect a channel with a stored token set to a file path. The target file must be readable by the backend process.