https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 19:33:41 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115932 <p>When a post is published, Postiz treats a media path that is not a web address as a file on the server&#39;s disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.</p> <p>The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend&#39;s memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.</p> <p>When a post is published, Postiz treats a media path that is not a web address as a file on the server&#39;s disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.</p> <p>The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend&#39;s memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115932 https://db.gcve.eu/vuln/ghsa-rmc2-p2gv-m88f <p>When a post is published, Postiz treats a media path that is not a web address as a file on the server&#39;s disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.</p> <p>The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend&#39;s memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.</p> <p>When a post is published, Postiz treats a media path that is not a web address as a file on the server&#39;s disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.</p> <p>The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend&#39;s memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.</p> https://db.gcve.eu/vuln/ghsa-rmc2-p2gv-m88f