POSTIZ / CVE-2026-115932 / EXECUTION AUTOPSY
A media path crosses the file boundary
The advisory describes a working test, not a reconstruction of a customer breach.
Prerequisite: registered account Dashed boundary = upload root not enforced
01 / USER INPUT
A post carries a media path
Controlled input
A local path, not a web URLSelf-registration is open by default.
What mattersThe user does not need administrator rights.
Local media path. Open sign-up; no admin rights needed.
02 / WORKER
A path becomes a disk read
Path interpretation
Non-web path → local fileThe publishing worker opens the path.
What mattersNo confinement to the upload directory.
Non-web path becomes disk read. Upload root not checked.
03 / FILESYSTEM
A file outside uploads is read
Controlled test
File delivered byte for byteThe record reports an unmodified-build test.
What mattersReach depends on worker file permissions.
Test delivered bytes. Worker access sets file reach.
04 / OUTPUT
An attachment leaves the server
Main route condition
Discord provider configuredThe user-controlled Discord channel receives the file.
What mattersDisabling Discord does not close other routes.
Configured Discord gets attachment. Other routes remain.
BROKEN BOUNDARY: the media path is allowed to name a server file outside the upload root.
Alternative routes
The advisory also describes file-existence checking and another file-delivery path.
The advisory also describes file-existence checking and another file-delivery path.
Evidence limit
Controlled validation is not evidence of a customer incident.
Controlled validation is not evidence of a customer incident.